PT-2023-20975 · WordPress · Groundhogg

István Márton + 1 · Published 2023-05-20 · Updated 2023-05-25 · CVE-2023-2715

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Groundhogg plugin for WordPress versions up to, and including, 2.7.9.8

Description The issue is due to a missing capability check on the submit ticket function, allowing authenticated attackers to create a support ticket that sends the website's data to the plugin developer. It is also possible to create an admin access with an auto login link that is sent to the plugin developer with the ticket. This only works if the plugin is activated with a valid license.

Recommendations For versions up to, and including, 2.7.9.8, update to a version higher than 2.7.9.8 to resolve the issue. As a temporary workaround, consider disabling the submit ticket function until a patch is available. Restrict access to the plugin's support ticket functionality to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-2715

Affected Products

Groundhogg

References · 7

• https://osv.dev/vulnerability/CVE-2023-2715 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2715 · Security Note
• https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/help/help-page.php#L220 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/24747507-8f24-499e-a257-d379dc171e18?source=cve · Note
• https://t.me/cvenotify/50842 · Telegram Post
• https://t.me/cibsecurity/64478 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/help-page.php · Note