CVE-2023-6000

MEDIUMNuclei

Popup Builder < 4.2.3 - Unauthenticated Stored XSS

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-6000 has a selected CVSS score of 6.1 (medium); EIP currently links 2 repository PoCs, 1 Nuclei template, and 4 lab environments.

Description

The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 10, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
2
Nuclei templates
1
Lab environments
4

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 16, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Popup Builder

Default status: unaffected

CVE ListBefore 4.2.3affected

popup_builder

Browse sygnoos / popup_builder
VulnCheckVersion data not supplied

Proofs of concept

2

Repository PoCs

GitHubrxerium/CVE-2023-6000Repository PoCby rxerium2Not analyzed3 files

3.2 KiB

GitHub
PoC details
GitHubRonF98/CVE-2023-6000-POCRepository PoCby RonF981Not analyzed1 file

7.3 KiB

GitHub
PoC details

Docker lab environments

4
GitHub

docker-compose.nginx.yml

ayinedjimi/wordpress-vulnerable-labCreated Vuln labCVE-2019-17671CVE-2021-23017CVE-2023-2745CVE-2023-28121CVE-2023-3460CVE-2023-5360CVE-2023-6000CVE-2024-2194CVE-2024-2879Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that runs an alternative nginx 1.18 + PHP 8.1-FPM stack for a WordPress vulnerability lab. It reuses the WordPress filesystem from a base lab and adds a deliberately misconfigured nginx vhost and a loose ModSecurity-style ruleset for training purposes.

docker-compose.nginx.yml:1-49config/nginx/default.conf:1-46config/nginx/modsec.conf:1-41

Lab assessment

Vulnerability lab

The compose file and its referenced configs explicitly describe intentional bugs (alias traversal, source disclosure, verbose headers) and a deliberately weak WAF ruleset as training targets for security education, CTF exercises, and scanner benchmarking.

docker-compose.nginx.yml:1-6config/nginx/default.conf:1-10config/nginx/modsec.conf:1-41
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

nginx

web serverreverse proxyvulnerable target

nginx 1.18 container serving WordPress files on port 31888. It uses a deliberately vulnerable vhost configuration with three intentional bugs: a slash-confused alias enabling directory traversal, a misordered static file check that discloses PHP source for backup files, and server_tokens on to leak the nginx version. It also includes a loose ModSecurity-style ruleset that blocks only a subset of obvious payloads.

docker-compose.nginx.yml:37-49config/nginx/default.conf:1-46config/nginx/modsec.conf:1-41

wp-php

PHP-FPM backendWordPress application server

PHP 8.1-FPM container that processes PHP requests for WordPress. It shares the wp_data volume with the main WordPress lab and connects to the 'db' service for the database.

docker-compose.nginx.yml:22-36
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2019-17671

Insufficient evidence

CVE-2019-17671 is a WordPress core vulnerability (REST API user leak) mentioned in the README for the WP 5.2 matrix. The nginx compose file does not reference this CVE, and no evidence in the supplied packet shows that the nginx stack specifically exercises or reproduces it.

README.md:1-410

CVE-2021-23017

Supported by supplied evidence

The compose file explicitly states it runs 'nginx 1.18 (CVE-2021-23017 era)' and the README lists CVE-2021-23017 as an infrastructure CVE. The nginx:1.18 image is used, which is the version associated with this CVE.

docker-compose.nginx.yml:1-6docker-compose.nginx.yml:37-38

CVE-2023-2745

Insufficient evidence

CVE-2023-2745 is a WordPress core directory traversal vulnerability mentioned in the README for the WP 6.1 matrix. The nginx compose file does not reference this CVE, and no evidence shows it is exercised by this specific stack.

README.md:1-410

CVE-2023-28121

Insufficient evidence

CVE-2023-28121 is a WooCommerce auth bypass vulnerability. The README lists it as a challenge, but the nginx compose file and its configs do not reference it, and no evidence shows it is specifically targeted by this stack.

README.md:1-410

CVE-2023-3460

Insufficient evidence

CVE-2023-3460 is an Ultimate Member privilege escalation vulnerability. The README lists it as a challenge, but the nginx compose file and its configs do not reference it, and no evidence shows it is specifically targeted by this stack.

README.md:1-410

CVE-2023-5360

Insufficient evidence

CVE-2023-5360 is a Royal Elementor Addons arbitrary file upload vulnerability. The README lists it as a challenge, but the nginx compose file and its configs do not reference it, and no evidence shows it is specifically targeted by this stack.

README.md:1-410

CVE-2023-6000

Insufficient evidence

CVE-2023-6000 is a Popup Builder stored XSS vulnerability. The README lists it as a challenge, but the nginx compose file and its configs do not reference it, and no evidence shows it is specifically targeted by this stack.

README.md:1-410

CVE-2024-2194

Insufficient evidence

CVE-2024-2194 is a WP Statistics SQL injection vulnerability. The README lists it as a challenge, but the nginx compose file and its configs do not reference it, and no evidence shows it is specifically targeted by this stack.

README.md:1-410

CVE-2024-2879

Insufficient evidence

CVE-2024-2879 is a miniOrange SAML SSO vulnerability. The README lists it as a challenge, but the nginx compose file and its configs do not reference it, and no evidence shows it is specifically targeted by this stack.

README.md:1-410
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • The base WordPress lab (docker-compose.yml) must be running, as this stack reuses the 'db' service and the 'wp_data' volume.docker-compose.nginx.yml:1-10
  • The config files ./config/nginx/default.conf and ./config/nginx/modsec.conf must be present on the host filesystem.docker-compose.nginx.yml:44-48

Evidence-described exercise path

  1. Start the base WordPress lab and the nginx stack: docker compose -f docker-compose.yml -f docker-compose.nginx.yml up -ddocker-compose.nginx.yml:8-9
  2. Access the nginx-served WordPress at http://localhost:31888docker-compose.nginx.yml:10
  3. Exploit the intentional nginx bugs: directory traversal via alias (e.g., GET /static../wp-config.php), PHP source disclosure via .php~ files, and version disclosure via Server header.config/nginx/default.conf:1-46
  4. Test the loose ModSecurity ruleset by sending blocked payloads (e.g., <script>, UNION SELECT) and bypassing with encoded or case-mixed variants.config/nginx/modsec.conf:1-41
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The compose file maps port 31888 to the container's port 80, mounts configuration files read-only, and shares a named volume. It does not use privileged mode, mount the Docker socket, or expose any host paths beyond the lab's own config directory. All described behavior targets the lab's own WordPress target and the intentional nginx misconfigurations. No evidence of host escape, external connectivity, persistence, credential theft, or destructive behavior is present.

docker-compose.nginx.yml:22-49
Review boundaries

What the analysis did not establish

  • The packet does not include the base docker-compose.yml, so the full lab topology (db service, wp_data volume definition) is not visible.
  • The nginx:1.18 and php:8.1-fpm-alpine images are not inspected; their internal behavior is unknown.
  • The README references many CVEs and components not present in the supplied evidence files; their relevance to this specific compose unit is not assessed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

docker-compose.yml

ayinedjimi/wordpress-vulnerable-labCreated Vuln labCVE-2019-17671CVE-2023-2745CVE-2023-28121CVE-2023-3460CVE-2023-5360CVE-2023-6000CVE-2024-2194CVE-2024-2879Compose · mixed

1 Compose manifest · 1 Dockerfile · 7 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds a custom WordPress 5.3 image and runs it alongside MySQL, phpMyAdmin, MailHog, Adminer, Redis, and Memcached. The WordPress image is intentionally loaded with vulnerable plugins, themes, and misconfigurations for security training, CTF, and scanner benchmarking.

docker-compose.yml:1-113Dockerfile:1-53README.md:1-410

Lab assessment

Vulnerability lab

The README explicitly states the project is 'intentionally insecure' and designed for security training, CTF, and scanner benchmarking. The Dockerfile builds a WordPress 5.3 image with intentional info leaks (phpinfo, .env, .git, debug.log, etc.), and the install script installs dozens of vulnerable plugins and themes with known CVEs. The compose file exposes services with no authentication and includes comments about intentional misconfigurations.

README.md:1-410Dockerfile:1-53scripts/install.sh:1-247
Lab shapeCompose · mixed
Services7
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

wordpress

vulnerable WordPress target

Custom WordPress 5.3 image built from the Dockerfile. It includes intentional info leaks (phpinfo, .env, .git, debug.log, wp-config.php.bak, dump.sql), a permissive .htaccess, and is later populated with vulnerable plugins and themes by install.sh. It serves as the primary target for vulnerability exercises.

Dockerfile:1-53scripts/install.sh:1-247

db

MySQL database

MySQL 5.7 database service for WordPress. Exposed on host port 31306 with root/wordpress credentials. Used by WordPress and accessible for direct database attacks.

docker-compose.yml:20-33

phpmyadmin

database administration tool

phpMyAdmin 5 service exposed on host port 31339. Provides web-based MySQL administration with root credentials. Useful for lab exercises involving database access.

docker-compose.yml:65-76

mailhog

email capture tool

MailHog service for capturing emails sent by WordPress. SMTP on host port 31325 and web UI on 31340. Used to observe email-based attacks or password resets.

docker-compose.yml:78-84

adminer

database administration tool

Adminer service exposed on host port 31341. Another web-based database management tool, providing an alternative to phpMyAdmin for lab exercises.

docker-compose.yml:86-93

redis

in-memory data store (intentionally misconfigured)

Redis 6 service exposed on host port 31379 with no authentication. Intentionally misconfigured for lab exercises involving unauthorized access.

docker-compose.yml:95-101

memcached

in-memory object cache (intentionally misconfigured)

Memcached 1.6 service exposed on host port 31211 with no ACL. Intentionally misconfigured for lab exercises involving unauthorized access.

docker-compose.yml:103-109

install.sh

lab setup script

Bash script that boots the Docker Compose stack, installs WordPress core, creates users with weak passwords, and installs 54 vulnerable plugins and 5 vulnerable themes. It also wires SMTP to MailHog.

scripts/install.sh:1-247

verify.sh

lab verification script

Bash script that checks HTTP reachability of installed vulnerable plugins, intentional info leaks, and WordPress core fingerprints to confirm the lab is correctly set up.

scripts/verify.sh:1-71

plant-flags.sh

CTF flag planting script

Bash script that plants CTF flags into the running lab for documented kill-chain exercises. Flags are placed in files, database options, and a MinIO bucket.

scripts/plant-flags.sh:1-153

benchmark.sh

scanner benchmarking script

Bash script that runs popular WordPress scanners (BAZOOKA, WPScan, Nuclei) against the lab and saves reports for benchmarking.

scripts/benchmark.sh:1-32

reset.sh

lab reset script

Bash script that tears down the Docker Compose stack, removes volumes, and re-runs install.sh to rebuild the lab from scratch.

scripts/reset.sh:1-14
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2019-17671

Insufficient evidence

The README mentions CVE-2019-17671 in the context of the WordPress version matrix (WP 5.2 on port 31352) as a 'REST API user leak'. However, the supplied evidence does not include the matrix compose file or any configuration that demonstrates this CVE is actually exploitable in the provided lab unit. The main lab uses WP 5.3, not 5.2.

README.md:1-410

CVE-2023-2745

Insufficient evidence

The README mentions CVE-2023-2745 in the context of the WordPress version matrix (WP 6.1 on port 31361) as a 'directory traversal'. The supplied evidence does not include the matrix compose file or any configuration that demonstrates this CVE is actually exploitable in the provided lab unit. The main lab uses WP 5.3, not 6.1.

README.md:1-410

CVE-2023-28121

Supported by supplied evidence

The install.sh script installs WooCommerce 7.0.0 with the comment 'CVE-2023-28121 (Auth bypass)'. The README also lists this CVE under CTF challenges. The plugin is installed and activated, making the vulnerable version present in the lab.

scripts/install.sh:138README.md:1-410

CVE-2023-3460

Supported by supplied evidence

The install.sh script installs ultimate-member 2.6.6 with the comment 'CVE-2023-3460 (PE -> admin)'. The README also lists this CVE under CTF challenges. The plugin is installed and activated, making the vulnerable version present in the lab.

scripts/install.sh:86README.md:1-410

CVE-2023-5360

Supported by supplied evidence

The install.sh script installs royal-elementor-addons 1.3.78 with the comment 'CVE-2023-5360 (AFU/RCE)'. The README also lists this CVE under CTF challenges. The plugin is installed and activated, making the vulnerable version present in the lab.

scripts/install.sh:95README.md:1-410

CVE-2023-6000

Supported by supplied evidence

The install.sh script installs popup-builder 4.2.3 with the comment 'CVE-2023-6000 (Stored XSS)'. The README also lists this CVE under CTF challenges. The plugin is installed and activated, making the vulnerable version present in the lab.

scripts/install.sh:97README.md:1-410

CVE-2024-2194

Supported by supplied evidence

The install.sh script installs wp-statistics 13.2.10 with the comment 'CVE-2024-2194 (SQLi)'. The README also lists this CVE under CTF challenges. The plugin is installed and activated, making the vulnerable version present in the lab.

scripts/install.sh:84README.md:1-410

CVE-2024-2879

Supported by supplied evidence

The install.sh script installs miniorange-saml-20-single-sign-on 5.0.7 with the comment 'CVE-2024-2879 (XML AB class)'. The README also lists this CVE under CTF challenges. The plugin is installed and activated, making the vulnerable version present in the lab.

scripts/install.sh:136README.md:1-410
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed on the host.README.md:1-410
  • The lab must be run on localhost or an isolated network; it must not be exposed to the public internet.docker-compose.yml:5README.md:1-410
  • The install.sh script must be executed to boot the stack, install WordPress, and populate vulnerable plugins/themes.scripts/install.sh:1-247
  • For CTF kill-chain exercises, plant-flags.sh must be run after the stack is up.scripts/plant-flags.sh:1-153

Evidence-described exercise path

  1. Clone the repository and navigate into the directory.README.md:1-410
  2. Run install.sh to boot the Docker Compose stack, install WordPress core, create users, and install vulnerable plugins/themes.scripts/install.sh:1-247
  3. Access the WordPress target at http://localhost:31338 and other services at their respective ports.docker-compose.yml:1-113
  4. Optionally run verify.sh to confirm that vulnerable plugins and intentional info leaks are reachable.scripts/verify.sh:1-71
  5. For CTF exercises, run plant-flags.sh to seed flags, then follow documented kill-chain walkthroughs.scripts/plant-flags.sh:1-153
  6. To benchmark scanners, run benchmark.sh against the lab URL.scripts/benchmark.sh:1-32
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab environment. The Dockerfile and scripts install vulnerable software and plant flags only within the WordPress container and its associated services. There is no evidence of host escape, external connections, persistence outside the lab, credential theft beyond the lab's own fake credentials, or destructive behavior. Port mappings and intentional misconfigurations are explicitly documented as part of the lab's training purpose.

docker-compose.yml:1-113Dockerfile:1-53scripts/install.sh:1-247scripts/plant-flags.sh:1-153
Review boundaries

What the analysis did not establish

  • The packet does not include the docker-compose.aux.yml, docker-compose.nginx.yml, or docker-compose.matrix.yml files referenced in the README, so the full multi-stack environment cannot be assessed.
  • The packet does not include the actual plugin/theme ZIP files or the custom mini-plugin source code beyond the listed PHP files, so the exact vulnerable code paths cannot be verified.
  • The install.sh script downloads plugins from wordpress.org and wp-cli.phar from GitHub; these external downloads are not inspected and could introduce supply-chain risk, but the script itself does not exhibit malicious intent.
  • The plant-flags.sh script copies a database dump to a MinIO container and makes it publicly downloadable; this is part of a documented CTF chain and not hidden, but it does expose lab data to the Docker network.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

docker-compose.aux.yml

ayinedjimi/wordpress-vulnerable-labCreated Vuln labCVE-2019-17671CVE-2023-2745CVE-2023-28121CVE-2023-3460CVE-2023-5360CVE-2023-6000CVE-2024-2194CVE-2024-2879Compose · images

1 Compose manifest · 6 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose file defining auxiliary services for a WordPress vulnerability lab, including Elasticsearch, MinIO, Gitea, and a fake AWS IMDS, all intentionally misconfigured for security training.

docker-compose.aux.yml:1-6

Lab assessment

Vulnerability lab

The file header explicitly states it is part of 'wordpress-vulnerable-lab' for 'scanner / pentest training' with intentionally misconfigured services.

docker-compose.aux.yml:1-6
Lab shapeCompose · images
Services6
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

elasticsearch

vulnerable targetauxiliary service

Elasticsearch 6.8.23 with no authentication, single-node, and open bind, exposing port 9200 on host port 31392.

docker-compose.aux.yml:24-36

minio

vulnerable targetauxiliary service

MinIO object storage with default credentials (minioadmin/minioadmin), exposing API on host port 31900 and console on 31901.

docker-compose.aux.yml:38-50

minio-init

initializationseed data

One-shot container that creates a public 'wp-backups' bucket in MinIO and uploads a dummy SQL dump containing a fake user table.

docker-compose.aux.yml:52-68

gitea

vulnerable targetauxiliary service

Gitea 1.18.5 with install lock disabled, open registration, and weak admin credentials, exposing HTTP on host port 31300 and SSH on 31322.

docker-compose.aux.yml:70-85

gitea-init

initializationseed data

One-shot container that seeds Gitea with a public organization 'internal' and a repository 'secrets-leak' containing a .env file with fake secrets in its commit history.

docker-compose.aux.yml:89-120

aws-metadata

vulnerable targetauxiliary servicefake AWS IMDS

Nginx serving a fake AWS Instance Metadata Service (IMDS) v1 on host port 31254, with network aliases 'aws-metadata' and '169.254.169.254.nip.io', serving static files from a bind-mounted config directory.

docker-compose.aux.yml:124-137
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2019-17671

Insufficient evidence

This CVE is mentioned in the README as a WordPress core vulnerability for version 5.2, but the auxiliary compose file does not include WordPress or any component related to this CVE.

README.md:1-410

CVE-2023-2745

Insufficient evidence

This CVE is mentioned in the README as a WordPress core vulnerability for version 6.1, but the auxiliary compose file does not include WordPress or any component related to this CVE.

README.md:1-410

CVE-2023-28121

Insufficient evidence

This CVE is mentioned in the README as a WooCommerce auth bypass, but the auxiliary compose file does not include WooCommerce or any component related to this CVE.

README.md:1-410

CVE-2023-3460

Insufficient evidence

This CVE is mentioned in the README as a privilege escalation in Ultimate Member plugin, but the auxiliary compose file does not include WordPress or that plugin.

README.md:1-410

CVE-2023-5360

Insufficient evidence

This CVE is mentioned in the README as an arbitrary file upload in Royal Elementor Addons, but the auxiliary compose file does not include WordPress or that plugin.

README.md:1-410

CVE-2023-6000

Insufficient evidence

This CVE is mentioned in the README as a stored XSS in Popup Builder, but the auxiliary compose file does not include WordPress or that plugin.

README.md:1-410

CVE-2024-2194

Insufficient evidence

This CVE is mentioned in the README as a SQL injection in WP Statistics, but the auxiliary compose file does not include WordPress or that plugin.

README.md:1-410

CVE-2024-2879

Insufficient evidence

This CVE is mentioned in the README as an XML authentication bypass in miniOrange SAML, but the auxiliary compose file does not include WordPress or that plugin.

README.md:1-410
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • The base WordPress lab (docker-compose.yml) must be running to provide the WordPress container that can reach these services by service name.docker-compose.aux.yml:5-6
  • Docker and Docker Compose must be installed to run the compose file.docker-compose.aux.yml:8

Evidence-described exercise path

  1. Start the auxiliary services alongside the base lab using 'docker compose -f docker-compose.yml -f docker-compose.aux.yml up -d'.docker-compose.aux.yml:8
  2. From the WordPress container, perform SSRF to access the fake AWS IMDS at http://aws-metadata/latest/meta-data/iam/security-credentials/wpvl-lab-role to retrieve fake credentials.docker-compose.aux.yml:124-137config/aws-metadata/latest/meta-data/iam/security-credentials/wpvl-lab-role:1-9
  3. Use the retrieved credentials to access the public MinIO bucket 'wp-backups' and download the dummy database dump.docker-compose.aux.yml:52-68
  4. Explore the Gitea repository 'internal/secrets-leak' to find the .env file with fake secrets in the commit history.docker-compose.aux.yml:89-120
  5. Access Elasticsearch without authentication to enumerate indices via GET /_cat/indices.docker-compose.aux.yml:24-36
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All services are intentionally misconfigured for training purposes within a contained lab environment. No behavior targets the host, external systems, or persists beyond the lab. The fake credentials and data are clearly labeled as examples.

docker-compose.aux.yml:1-6config/aws-metadata/latest/meta-data/iam/security-credentials/wpvl-lab-role:1-9
Review boundaries

What the analysis did not establish

  • The analysis is limited to the auxiliary compose file and its directly referenced local files; the base WordPress lab and other phases are not included in this packet.
  • No Dockerfile is present; the images are pre-built and their internal behavior is not inspected.
  • The packet does not include the full lab environment, so the interaction between these services and the WordPress container is not fully visible.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

docker-compose.matrix.yml

ayinedjimi/wordpress-vulnerable-labCreated Vuln labCVE-2006-0207CVE-2019-17671CVE-2023-2745CVE-2023-28121CVE-2023-3460CVE-2023-5360CVE-2023-6000CVE-2024-2194CVE-2024-2879Compose · images

1 Compose manifest · 6 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose file defining a multi-version WordPress benchmarking matrix with four WordPress containers (5.2, 5.3, 6.1, 6.8), a MySQL initialization service, and a one-shot installer. It is part of a larger intentionally vulnerable WordPress lab.

docker-compose.matrix.yml:1-158

Lab assessment

Vulnerability lab

The compose file is explicitly described as a 'Multi-WordPress-version benchmarking matrix' for a vulnerability lab. It references specific CVEs (CVE-2019-17671, CVE-2023-2745) in comments and mounts a directory of intentionally vulnerable plugins. The README confirms the project is 'intentionally insecure' for security training.

docker-compose.matrix.yml:2-3docker-compose.matrix.yml:12-15README.md:1
Lab shapeCompose · images
Services6
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db-matrix-init

database initializer

A short-lived MySQL 5.7 container that waits for the 'db' service to be ready, then creates four databases (wp52, wp53, wp61, wp68) and grants privileges to 'wpuser'.

docker-compose.matrix.yml:19-38

wp52

vulnerable WordPress 5.2 target

WordPress 5.2 container exposed on port 31352, with a bind-mounted plugins directory (read-only) and a dedicated database. Intended to demonstrate CVE-2019-17671.

docker-compose.matrix.yml:40-58

wp53

vulnerable WordPress 5.3 target

WordPress 5.3 container exposed on port 31353, with a bind-mounted plugins directory (read-only) and a dedicated database. Mirrors the main lab for parity.

docker-compose.matrix.yml:60-78

wp61

vulnerable WordPress 6.1 target

WordPress 6.1 container exposed on port 31361, with a bind-mounted plugins directory (read-only) and a dedicated database. Intended to demonstrate CVE-2023-2745.

docker-compose.matrix.yml:80-98

wp68

hardened WordPress 6.8 baseline

WordPress 6.8 container exposed on port 31368, with a dedicated database but no legacy plugin bind mount. Intended as a clean target for false-positive testing.

docker-compose.matrix.yml:100-118

matrix-install

one-shot WordPress installer

A WordPress CLI container that runs 'wp core install' on each of the four WordPress containers to set up admin/admin credentials. It uses the wp52 data volume and runs as user 33:33.

docker-compose.matrix.yml:120-152
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2006-0207

Insufficient evidence

The CVE is mentioned in a comment within the bz-crlf-injection plugin as a mitigation reference, but the compose file does not directly demonstrate or exercise this CVE. No evidence links the matrix environment to this CVE.

plugins/bazooka-vuln-pack/bz-crlf-injection/bz-crlf-injection.php:12-13

CVE-2019-17671

Supported by supplied evidence

The compose file explicitly associates the wp52 service with 'CVE-2019-17671 REST API user leak' in a comment, and the service uses the vulnerable WordPress 5.2 image.

docker-compose.matrix.yml:12docker-compose.matrix.yml:41

CVE-2023-2745

Supported by supplied evidence

The compose file explicitly associates the wp61 service with 'CVE-2023-2745 directory traversal' in a comment, and the service uses the vulnerable WordPress 6.1 image.

docker-compose.matrix.yml:14docker-compose.matrix.yml:81

CVE-2023-28121

Insufficient evidence

This CVE is listed in the README and install script for a WooCommerce plugin, but the matrix compose file does not reference it or include any WooCommerce service. No evidence ties it to this specific compose unit.

README.md:1

CVE-2023-3460

Insufficient evidence

This CVE is listed in the README and install script for the Ultimate Member plugin, but the matrix compose file does not reference it or include any Ultimate Member service. No evidence ties it to this specific compose unit.

README.md:1

CVE-2023-5360

Insufficient evidence

This CVE is listed in the README and install script for the Royal Elementor Addons plugin, but the matrix compose file does not reference it or include any Royal Elementor Addons service. No evidence ties it to this specific compose unit.

README.md:1

CVE-2023-6000

Insufficient evidence

This CVE is listed in the README and install script for the Popup Builder plugin, but the matrix compose file does not reference it or include any Popup Builder service. No evidence ties it to this specific compose unit.

README.md:1

CVE-2024-2194

Insufficient evidence

This CVE is listed in the README and install script for the WP Statistics plugin, but the matrix compose file does not reference it or include any WP Statistics service. No evidence ties it to this specific compose unit.

README.md:1

CVE-2024-2879

Insufficient evidence

This CVE is listed in the README and install script for the miniOrange SAML plugin, but the matrix compose file does not reference it or include any miniOrange SAML service. No evidence ties it to this specific compose unit.

README.md:1
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • The main 'db' service from docker-compose.yml must be running, as db-matrix-init depends on it.docker-compose.matrix.yml:24-25
  • The host's pre-built vulnerable plugin set must be present in the ./plugins directory, as it is bind-mounted into wp52, wp53, and wp61.docker-compose.matrix.yml:55-56
  • The compose file must be used together with the base docker-compose.yml, as stated in the usage comment.docker-compose.matrix.yml:5

Evidence-described exercise path

  1. Start the matrix stack alongside the base lab: docker compose -f docker-compose.yml -f docker-compose.matrix.yml up -ddocker-compose.matrix.yml:5
  2. Wait for db-matrix-init to create the four databases and grant privileges.docker-compose.matrix.yml:26-37
  3. Wait for matrix-install to run wp core install on each WordPress container, creating admin/admin accounts.docker-compose.matrix.yml:128-148
  4. Access the WordPress instances on their respective ports (31352, 31353, 31361, 31368) to exercise version-specific vulnerabilities or benchmark scanners.docker-compose.matrix.yml:11-15
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The compose file defines a self-contained lab environment with no evidence of host escape, external connectivity, persistence, credential theft, or destructive behavior. All services are standard Docker images, and the only bind mount is a read-only plugins directory. The one-shot installer creates known admin accounts, which is expected for a vulnerability lab.

docker-compose.matrix.yml:1-158
Review boundaries

What the analysis did not establish

  • The compose file references an external 'db' service and './plugins' directory that are not defined within this unit; their contents and behavior are not inspected.
  • The unit is a partial compose file intended to be merged with docker-compose.yml; the full merged environment is not analyzed.
  • Several proposed CVEs are only mentioned in the broader README and install script, not directly exercised by this compose file.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSSCVSS 6.1

The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.

Impact

Unauthenticated attackers can update existing popups and inject raw JavaScript to achieve stored cross-site scripting attacks against WordPress Popup Builder users.

Remediation

Fixed in 4.2.3

WeaknessesCWE-79
Authorsriteshs4hu
Template tagscvecve2023wordpresswp-pluginwpwpscanxssstoredintrusivevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*
FOFA: body="/wp-content/plugins/popup-builder"
https://wordpress.org/plugins/popup-builder/ https://nvd.nist.gov/vuln/detail/cve-2023-6000 https://wpscan.com/vulnerability/cdb3a8bd-4ee0-4ce0-9029-0490273bcfc8/ https://github.com/rxerium/CVE-2023-6000

Source: ProjectDiscovery

References

3