Unauthorized Data Access in Groundhogg Plugin for WordPress
CVE-2023-2716
5.4MEDIUM
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 20 May 2023
Summary
The Groundhogg plugin for WordPress has a significant vulnerability that allows authenticated users with subscriber-level access or higher to bypass restrictions on file uploads. This is due to a missing capability check in the 'ajax_upload_file' function, present in versions up to and including 2.7.9.8. As a result, attackers can upload files associated with a contact and potentially gain visibility to all files previously uploaded for that contact, leading to unauthorized access and manipulation of sensitive data.
Affected Version(s)
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg * <= 2.7.9.8
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Lana Codes