WordPress Plugin Vulnerabilities

Groundhogg < 2.7.10 - Disable All Plugins via CSRF

Description

The plugin does not have CSRF check when enabling Safe-mode on the plugin, which could allow attackers to make logged-in admins perform such action via a CSRF attack leading to disabling all other plugins.

Affects Plugins

Plugin icon
groundhogg
Fixed in 2.7.10

References

CVE
CVE-2023-2717

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
d4ac6c57-522f-4093-8f93-df9399f4ce82

Timeline

Publicly Published
2023-05-19 (about 2 years ago)
Added
2023-05-23 (about 2 years ago)
Last Updated
2023-05-23 (about 2 years ago)

Other

Published
Title
Published
2023-11-28
Title
Affiliate Booster < 3.0.6 - Blocks Enabling/Disabling via CSRF
Published
2022-08-02
Title
Link Optimizer Lite <= 1.4.5 - Stored Cross-Site Scripting via CSRF
Published
2024-11-01
Title
APK Downloader <= 1.0.0 - Cross-Site Request Forgery to Stored Cross Site Scripting
Published
2023-02-07
Title
OWM Weather < 5.6.12 - Post Duplication via CSRF
Published
2025-02-03
Title
Login-box <= 2.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting