CVE-2023-2715

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's data to the plugin developer, and it is also possible to create an admin access with an auto login link that is also sent to the plugin developer with the ticket. It only works if the plugin is activated with a valid license.

• CWE-862
• CWE-862

• https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/help/help-page.php#L220Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/help-page.phpThird Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/24747507-8f24-499e-a257-d379dc171e18?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/help/help-page.php#L220Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/help-page.phpThird Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/24747507-8f24-499e-a257-d379dc171e18?source=cveThird Party Advisory

Published

May 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27132TSplus Remote Work 16.0.0.0 places a cleartext password on t…9.8
• CVE-2023-27133TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .…9.8
• CVE-2023-27135TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to con…9.8
• CVE-2023-2714The Groundhogg plugin for WordPress is vulnerable to unautho…4.3
• CVE-2023-27148A stored cross-site scripting (XSS) vulnerability in the Adm…4.8
• CVE-2023-27149A stored cross-site scripting (XSS) vulnerability in Enhance…4.8
• CVE-2023-27150openCRX 5.2.0 was discovered to contain a cross-site scripti…5.4
• CVE-2023-27151openCRX 5.2.0 was discovered to contain an HTML injection vu…6.1
• CVE-2023-27152DECISO OPNsense 23.1 does not impose rate limits for authent…9.8
• CVE-2023-27159Appwrite up to v1.2.1 was discovered to contain a Server-Sid…7.5
• CVE-2023-2716The Groundhogg plugin for WordPress is vulnerable to unautho…5.4
• CVE-2023-27160forem up to v2022.11.11 was discovered to contain a Server-S…7.2