CVE-2023-2717mediumCWE-352

CVE-2023-2717: fallo de gravedad media en trainingbusinesspros Groundhogg — CRM…

Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Groundhogg — CRM, Newsletters, and Marketing Automation

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.3%
The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validation on the 'enable_safe_mode' function. This makes it possible for unauthenticated attackers to enable safe mode, which disables all other plugins, via a forged request if they can successfully trick an administrator into performing an action such as clicking on a link. A warning message about safe mode is displayed to the admin, which can be easily disabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Productos afectados
trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation
CVEs relacionadas — trainingbusinesspros Groundhogg — CRM…

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-4206HIGHWordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File DeletionEPSS 1.6%CVE-2025-0394HIGHGroundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload FunctionEPSS 1.2%CVE-2026-109221HIGHGroundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field MappingEPSS 0.8%CVE-2026-18387MEDIUMGroundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' ParameterEPSS 0.7%CVE-2026-13333MEDIUMGroundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' ParameterEPSS 0.6%CVE-2023-2715MEDIUMGroundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket CreationEPSS 0.6%