Cross-Site Request Forgery Vulnerability in Groundhogg Plugin for WordPress

CVE-2023-2717

Summary

The Groundhogg plugin for WordPress is susceptible to a Cross-Site Request Forgery due to inadequate nonce validation in the 'enable_safe_mode' function. This flaw allows unauthenticated attackers to trigger safe mode, which disables all other plugins, if they can deceive an administrator into performing a specific action, such as clicking on a malicious link. Once activated, a warning message about safe mode is shown to the administrator, which could be easily dismissed, potentially compromising the site's functionality.

References