4.3

CVE-2023-2715

Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation

Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's data to the plugin developer, and it is also possible to create an admin access with an auto login link that is also sent to the plugin developer with the ticket. It only works if the plugin is activated with a valid license.
Mögliche Gegenmaßnahme
Groundhogg — CRM, Newsletters, and Marketing Automation: Update to version 2.7.10, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Groundhogg ≫ Groundhogg SwPlatformwordpress Version <= 2.7.9.8
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Groundhogg — CRM, Newsletters, and Marketing Automation
Version *-2.7.8.9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.56% 0.422
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
security@wordfence.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/help-page.php
Third Party Advisory
https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/help/help-page.php#L220
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/24747507-8f24-499e-a257-d379dc171e18?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/24747507-8f24-499e-a257-d379dc171e18
Third Party Advisory