CVE-2023-2714mediumCWE-862

CVE-2023-2714: medium-severity vulnerability in trainingbusinesspros Groundhogg — CRM…

Groundhogg <= 2.7.9.8 - Missing Authorization to Update License

Published · Updated

Follow this CVE+ Monitor Groundhogg — CRM, Newsletters, and Marketing Automation

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.5%
The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_license' functions in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the license key and support license key, but it can only be changed to a valid license key.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation
Related CVEs — trainingbusinesspros Groundhogg — CRM…

In the same product, most dangerous first.

CVE-2025-4206HIGHWordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File DeletionEPSS 1.6%CVE-2025-0394HIGHGroundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload FunctionEPSS 1.2%CVE-2026-109221HIGHGroundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field MappingEPSS 0.8%CVE-2026-18387MEDIUMGroundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' ParameterEPSS 0.7%CVE-2026-13333MEDIUMGroundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' ParameterEPSS 0.6%CVE-2023-2715MEDIUMGroundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket CreationEPSS 0.6%