CVE-2023-2716: 
WordPress vulnerability analysis and mitigation

The Groundhogg WordPress plugin (versions up to and including 2.7.9.8) contains a vulnerability identified as CVE-2023-2716, discovered in May 2023. The vulnerability stems from a missing capability check on the 'ajax_upload_file' function, which allows unauthorized access to data and modification of data (NVD, CVE).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 score of 5.4 (Medium). The security flaw exists in the plugin's file upload functionality where the 'ajax_upload_file' function lacks proper capability checks. This implementation oversight allows authenticated users with subscriber-level access or higher to perform unauthorized file operations (Wordfence).

The vulnerability allows authenticated attackers with subscriber-level access or higher to upload files to contacts and view all other uploaded files related to the contact. This unauthorized access could lead to potential data exposure and unauthorized modification of contact information (WPScan).

The vulnerability has been patched in version 2.7.10 of the Groundhogg plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).