WordPress Plugin Vulnerabilities

Groundhogg < 2.7.10 - Privilege Escalation via CSRF

Description

The plugin lacks CSRF protection when generating the auto login link through a shortcode, enabling attackers to manipulate the assigned user in the link.

Affects Plugins

Plugin icon
groundhogg
Fixed in 2.7.10

References

CVE
CVE-2023-2736

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
881b230d-4ed0-435c-bc8d-8f6705755275

Timeline

Publicly Published
2023-05-19 (about 2 years ago)
Added
2023-05-23 (about 2 years ago)
Last Updated
2023-05-23 (about 2 years ago)

Other

Published
Title
Published
2021-06-01
Title
MC4WP: Mailchimp for WordPress < 4.8.5 - Unauthorised Actions via CSRF
Published
2025-01-07
Title
Prayer Times Anywhere <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-04-10
Title
UsersWP < 1.2.6 - Cross-Site Request Forgery
Published
2025-04-09
Title
Spoiler Block <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-11-14
Title
Thrive Theme Builder < 3.24.2 - Cross-Site Request Forgery