blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2023-2715

MEDIUM 4.3 CVSS 3.1
Published
May 20, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's data to the plugin developer, and it is also possible to create an admin access with an auto login link that is also sent to the plugin developer with the ticket. It only works if the plugin is activated with a valid license.

Affected WordPress components

  • Groundhogg — CRM, Newsletters, and Marketing Automation Plugin · groundhogg
    Confirmed match Active
    Up to and including 2.7.8.9; Up to and including 2.7.9.8
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation — Up to and including 2.7.8.9
  • groundhogg groundhogg — Up to and including 2.7.9.8

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/help/help-page.php#L220 Third Party Advisory
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/help-page.php Third Party Advisory
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/24747507-8f24-499e-a257-d379dc171e18?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record