Cross-Site Request Forgery Vulnerability in Groundhogg Plugin for WordPress

CVE-2023-2736

Summary

The Groundhogg plugin for WordPress is affected by a Cross-Site Request Forgery vulnerability in versions up to 2.7.9.8. This vulnerability arises due to the missing nonce validation in the 'ajax_edit_contact' function, which may allow an authenticated attacker to exploit the plugin’s functionalities. By leveraging this weakness, an attacker could trick a site administrator into executing a malicious request, potentially enabling them to modify user privileges through an auto login link received via shortcode. This situation poses significant risks as it may allow unauthorized elevation of access rights.

References