Cross-Site Request Forgery Vulnerability in Groundhogg Plugin for WordPress

CVE-2023-2717

What is CVE-2023-2717?

The Groundhogg plugin for WordPress is susceptible to a Cross-Site Request Forgery due to inadequate nonce validation in the 'enable_safe_mode' function. This flaw allows unauthenticated attackers to trigger safe mode, which disables all other plugins, if they can deceive an administrator into performing a specific action, such as clicking on a malicious link. Once activated, a warning message about safe mode is shown to the administrator, which could be easily dismissed, potentially compromising the site's functionality.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References