CVE-2023-2717— Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-2717
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validation on the 'enable_safe_mode' function. This makes it possible for unauthenticated attackers to enable safe mode, which disables all other plugins, via a forged request if they can successfully trick an administrator into performing an action such as clicking on a link. A warning message about safe mode is displayed to the admin, which can be easily disabled.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨站请求伪造(CSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress Plugin Groundhogg 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress Plugin Groundhogg 2.7.9.8及之前版本存在安全漏洞，该漏洞源于缺少对enable_safe_mode函数的随机数验证，对提供的用户的验证不充分，攻击者利用该漏洞可以通过伪造的请求启用安全模式，从而禁用所有其他插件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| trainingbusinesspros | WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg | * ~ 2.7.9.8 | - |
II. Public POCs for CVE-2023-2717
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-2717
请登录查看更多情报信息。
Same Patch Batch · trainingbusinesspros · 2023-05-20 · 6 CVEs total
| CVE-2023-2736 | 7.5 HIGH | Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation |
| CVE-2023-2716 | 5.4 MEDIUM | Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload |
| CVE-2023-2735 | 4.9 MEDIUM | Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Short |
| CVE-2023-2715 | 4.3 MEDIUM | Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation |
| CVE-2023-2714 | 4.3 MEDIUM | Groundhogg <= 2.7.9.8 - Missing Authorization to Update License |
IV. Related Vulnerabilities
Same product: Groundhogg — CRM, Newsletters, and Marketing Automation
- CVE-2025-12750
Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection - CVE-2025-4206
WordPress CRM, Email & Marketing Automation for WordPress | - CVE-2025-1267
Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Store - CVE-2025-0394
Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary Fi - CVE-2023-2736
Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privil
Same vendor: trainingbusinesspros
- CVE-2026-4281
FormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Auth - CVE-2025-12750
Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection - CVE-2025-4206
WordPress CRM, Email & Marketing Automation for WordPress | - CVE-2025-1267
Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Store - CVE-2025-0394
Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary Fi
Same weakness: CWE-352
- CVE-2021-47953
OpenCart 3.0.3.7 Cross-Site Request Forgery via account/pass - CVE-2021-47946
OpenCart 3.0.36 Account Takeover via Cross Site Request Forg - CVE-2022-50955
WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery - CVE-2026-8194
osTicket Dispatcher class.dispatcher.php cross-site request - CVE-2026-42286
Emlog: Cross-Site Request Forgery in Admin Functions
V. Comments for CVE-2023-2717
No comments yet