CVE-2023-4975 in Website Builder Plugin
Summary
by MITRE • 10/25/2023
The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The vulnerability identified as CVE-2023-4975 affects the Website Builder by SeedProd plugin for WordPress, specifically impacting versions up to and including 6.15.13.1. This represents a critical security flaw that undermines the integrity of the plugin's administrative functions and exposes WordPress sites to potential compromise. The vulnerability stems from insufficient security controls within the plugin's codebase, creating a pathway for malicious actors to manipulate core system parameters without proper authentication.
The technical implementation flaw resides in the builder.php file where nonce validation mechanisms have been either omitted or incorrectly implemented. Nonce validation serves as a critical security measure in WordPress plugins to prevent unauthorized actions by ensuring that requests originate from legitimate administrative sessions. In this case, the absence of proper nonce verification allows attackers to craft malicious requests that appear to come from authenticated administrators, effectively bypassing the standard security protocols designed to protect administrative functions.
The operational impact of this Cross-Site Request Forgery vulnerability extends beyond simple data manipulation, as it specifically targets the Stripe connect token functionality within the plugin. This token serves as a critical authentication mechanism for payment processing integrations, making the vulnerability particularly dangerous for e-commerce sites that rely on the SeedProd plugin for their online storefronts. An attacker who successfully exploits this vulnerability could potentially redirect payment processing to their own Stripe account, resulting in financial loss and data compromise for site owners.
The attack vector for this vulnerability requires social engineering elements, as attackers must trick site administrators into performing actions such as clicking malicious links. This makes the vulnerability particularly insidious as it leverages human factors alongside technical weaknesses. The unauthenticated nature of the attack means that even sites without active administrator sessions could be compromised if an administrator inadvertently interacts with malicious content. This characteristic aligns with the Common Weakness Enumeration classification for CSRF vulnerabilities under CWE-352, which specifically addresses Cross-Site Request Forgery attacks.
The exploitation of this vulnerability demonstrates a significant gap in the plugin's security architecture, particularly concerning the handling of sensitive administrative functions. The lack of proper nonce validation in the builder.php file represents a fundamental security oversight that violates established WordPress security best practices. Organizations using the affected plugin versions face potential financial losses, data breaches, and reputational damage if attackers successfully exploit this vulnerability. The attack scenario becomes more likely in environments where administrators regularly interact with external content or where social engineering attacks are prevalent.
Mitigation strategies for CVE-2023-4975 should prioritize immediate plugin updates to versions that address the nonce validation issues. Site administrators must ensure they are running the latest available version of the SeedProd plugin that includes proper CSRF protection mechanisms. Additionally, implementing additional security layers such as web application firewalls and monitoring for unauthorized administrative actions can provide defense-in-depth protection. Regular security audits of WordPress plugins and themes should be conducted to identify similar vulnerabilities in other components of the web application stack. The vulnerability also highlights the importance of maintaining updated security practices and the necessity of following the ATT&CK framework's recommendations for defending against credential theft and administrative privilege escalation attacks. Organizations should also consider implementing role-based access controls and multi-factor authentication to reduce the impact of potential credential compromise scenarios.