CVE-2023-6187

What it actually does

The flaw is an authenticated arbitrary file upload caused by insufficient file type validation in the Paid Memberships Pro user-field handling path, specifically around `pmpro_paypalexpress_session_vars_for_user_fields` in versions up to and including 2.12.3. When the vulnerable payment-method and custom-field configuration is present, a low-privileged authenticated user can upload files that should have been rejected. If the uploaded file is placed in a web-accessible location and the web server executes it, the issue can become remote code execution, allowing command execution with the privileges of the web server account.

Why it matters to the business

A successful attack can lead to full compromise of a membership or commerce-oriented website, including theft of user data, manipulation of membership records, payment-flow disruption, malware hosting, defacement, and loss of customer trust. The issue requires authentication and a specific configuration, but the EPSS score indicates meaningful exploitation likelihood; it is not currently listed in CISA KEV and is not marked as ransomware-associated.

How an attack unfolds

An attacker first obtains or creates a low-privileged account, such as a subscriber-level user. They then identify that the site is using a vulnerable Paid Memberships Pro version and that PayPal Express or deprecated 2Checkout handling is enabled with a custom user field that is visible on the user profile but not at checkout. The attacker submits a crafted multipart request through the affected profile or payment-related workflow and provides a file with an executable extension or executable contents. Because the vulnerable code path does not sufficiently validate the uploaded file type, the file may be written to the server. If the upload lands under the web root and script execution is permitted, the attacker requests the uploaded file directly and uses it as a web shell to execute commands, modify site content, steal data, or establish persistence.

How to fix it

Upgrade Paid Memberships Pro to a version later than 2.12.3 that contains the fix. If using the listed package reference, apply the fixed `l2c2technologies/koha` Git commit `950fc8e101886821879066b33e389a47fb0a9782` where applicable, and verify the affected component mapping in the software inventory because the supplied product metadata differs from the vulnerability description. As immediate mitigations, disable PayPal Express or deprecated 2Checkout if not required, remove or reconfigure profile-only custom file-upload user fields, restrict uploads to safe extensions and MIME types, block script execution in upload directories, and ensure the web server cannot execute PHP or other scripts from user-writable paths.

How to confirm the fix worked

Confirm that the installed plugin or package version is no longer vulnerable: Paid Memberships Pro should be newer than 2.12.3, or the relevant fixed commit should be present where source-based deployments are used. Review the payment gateway configuration to ensure PayPal Express or deprecated 2Checkout is disabled if not needed. Attempt a controlled upload test with a non-executable test file and confirm executable extensions such as `.php`, `.phtml`, `.phar`, `.php5`, and similar script types are rejected or stored non-executably. Verify web server configuration prevents script execution under upload directories. Scan the filesystem for recently created executable files in WordPress upload paths and confirm no unexpected files are accessible through direct URLs.

Typical attack path

1. Register or compromise a low-privileged WordPress user account.
2. Confirm the target uses a vulnerable Paid Memberships Pro version and a vulnerable payment/custom-field configuration.
3. Submit a crafted file upload through the affected profile or payment workflow.
4. Upload a PHP or script-like payload that bypasses weak file type validation.
5. Locate the uploaded file in a web-accessible uploads path.
6. Request the uploaded payload over HTTP to execute commands.
7. Use the resulting access to steal data, create administrative users, modify plugins or themes, or deploy persistence.

How to detect it

Review web server access logs, WordPress application logs, authentication logs, file integrity monitoring, endpoint telemetry, and WAF events for signs of authenticated file upload abuse. Focus on low-privileged users performing multipart form uploads to profile, checkout, membership, or payment-related endpoints, followed by HTTP requests to newly created files in upload directories. Look for executable files created under WordPress content or uploads paths, especially files with PHP-like extensions or image-like names containing PHP code. Investigate requests that return HTTP 200 for uploaded `.php`, `.phtml`, `.phar`, or `.php5` files. Examine filesystem timestamps for files created around suspicious POST requests, and inspect contents for web-shell functions such as `eval`, `assert`, `system`, `shell_exec`, `passthru`, `proc_open`, `base64_decode`, or `gzinflate`. Also check for post-exploitation artifacts such as unexpected administrator accounts, modified theme/plugin files, new scheduled tasks, outbound connections from the web server process, or command execution spawned by the web server user.

• pmpro_paypalexpress_session_vars_for_user_fields
• wp-content/plugins/paid-memberships-pro/
• /wp-admin/profile.php
• /wp-admin/user-edit.php
• /membership-checkout/
• multipart/form-data
• .php
• .phtml
• .phar
• .php5
• wp-content/uploads/
• eval(
• assert(
• system(
• shell_exec(
• passthru(
• proc_open(
• base64_decode(
• gzinflate(
• FilesMatch ".*\\.php"
• AddType application/x-httpd-php

What your security team should do

• Prioritize patching internet-facing WordPress sites running Paid Memberships Pro versions up to and including 2.12.3, especially where user registration is open.
• Inventory sites using PayPal Express, deprecated 2Checkout, or custom profile-only file-upload user fields and treat them as higher-risk exposures.
• Disable script execution in all user-writable upload directories as a defense-in-depth control.
• Search for recently uploaded PHP-like files, web shells, unexpected administrator accounts, and modified plugin or theme files.
• Review access logs for authenticated multipart upload activity followed by direct requests to newly uploaded files.
• Rotate credentials and investigate broader compromise if a suspicious uploaded executable file is found.
• Because exploit maturity is not reported but EPSS is elevated, monitor threat intelligence and WAF telemetry for emerging public exploitation patterns.