CVE-2023-6738 : Security Advisory and Response

This CVE record was reserved on December 12, 2023, by Wordfence and was published on January 4, 2024. The vulnerability affects the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress up to version 1.7.8. Authenticated attackers with contributor-level permissions or above can exploit this vulnerability to execute arbitrary web scripts on injected pages.

Understanding CVE-2023-6738

This vulnerability affects the Page Builder: Pagelayer plugin for WordPress, allowing attackers to inject malicious scripts into pages, posing a risk to users accessing those pages.

What is CVE-2023-6738?

The vulnerability CVE-2023-6738 is a Stored Cross-Site Scripting issue in the Page Builder: Pagelayer plugin for WordPress. It arises from insufficient input sanitization and output escaping on user-supplied attributes in versions up to and including 1.7.8, potentially enabling attackers to execute arbitrary web scripts.

The Impact of CVE-2023-6738

This vulnerability could be exploited by authenticated attackers with contributor-level permissions or above, enabling them to inject malicious scripts that execute when users access the compromised pages. It is a moderate-severity vulnerability with a CVSS base score of 5.4 (Medium).

Technical Details of CVE-2023-6738

The vulnerability in the Page Builder: Pagelayer plugin for WordPress is classified under CWE-20: Improper Input Validation.

Vulnerability Description

The vulnerability allows attackers to exploit the 'pagelayer_header_code', 'pagelayer_body_open_code', and 'pagelayer_footer_code' meta fields, injecting malicious scripts into pages.

Affected Systems and Versions

All versions of the Page Builder: Pagelayer plugin up to and including 1.7.8 are vulnerable to this exploit.

Exploitation Mechanism

Attackers with contributor-level permissions or above can leverage this vulnerability to inject and execute arbitrary web scripts on compromised pages.

Mitigation and Prevention

It is crucial to take immediate action to mitigate the risks posed by CVE-2023-6738.

Immediate Steps to Take

Website administrators should update the Page Builder: Pagelayer plugin to version 1.7.9 or apply any other patches released by the plugin developer to address this vulnerability.

Long-Term Security Practices

Implement robust input validation and output escaping mechanisms in plugins and themes to prevent similar vulnerabilities in the future.

Patching and Updates

Regularly monitor for security updates and apply patches promptly to ensure the security of WordPress plugins and themes, mitigating the risk of exploitation.