Unauthorized Data Access in Groundhogg Plugin for WordPress

CVE-2023-2716

What is CVE-2023-2716?

The Groundhogg plugin for WordPress has a significant vulnerability that allows authenticated users with subscriber-level access or higher to bypass restrictions on file uploads. This is due to a missing capability check in the 'ajax_upload_file' function, present in versions up to and including 2.7.9.8. As a result, attackers can upload files associated with a contact and potentially gain visibility to all files previously uploaded for that contact, leading to unauthorized access and manipulation of sensitive data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References