Unauthorized Data Access in Groundhogg Plugin for WordPress
CVE-2023-2716
5.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 20 May 2023
What is CVE-2023-2716?
The Groundhogg plugin for WordPress has a significant vulnerability that allows authenticated users with subscriber-level access or higher to bypass restrictions on file uploads. This is due to a missing capability check in the 'ajax_upload_file' function, present in versions up to and including 2.7.9.8. As a result, attackers can upload files associated with a contact and potentially gain visibility to all files previously uploaded for that contact, leading to unauthorized access and manipulation of sensitive data.
Affected Version(s)
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg * <= 2.7.9.8