CVE-2024-37235: Groundhogg CSRF Vulnerability

CVE-2024-37235 Overview

CVE-2024-37235 is a Cross-Site Request Forgery (CSRF) vulnerability in the Groundhogg plugin for WordPress, developed by Adrian Tobey. The flaw affects all versions of Groundhogg up to and including 3.4.2.3. An attacker can craft a malicious web page that, when visited by an authenticated Groundhogg user, triggers unintended state-changing actions in the plugin. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows an attacker to induce an authenticated WordPress user to perform Groundhogg actions without consent, resulting in limited integrity impact on plugin data.

Affected Products

Groundhogg WordPress plugin versions up to and including 3.4.2.3
Deployments of Groundhogg on WordPress sites managed by Adrian Tobey
Any WordPress installation running the vulnerable Groundhogg plugin build

Discovery Timeline

2025-01-02 - CVE-2024-37235 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-37235

Vulnerability Analysis

Groundhogg is a customer relationship management (CRM) and marketing automation plugin for WordPress. The vulnerable versions expose one or more state-changing request handlers that do not properly validate anti-CSRF tokens (nonces) or verify request origin.

An attacker crafts an HTML page containing a form or script that targets a Groundhogg endpoint. When an authenticated administrator or privileged Groundhogg user visits the attacker-controlled page, the browser submits the forged request along with valid session cookies. The plugin processes the request as if it originated from a legitimate user action.

The impact is limited to integrity of plugin-managed data. Confidentiality and availability are not directly affected, and user interaction is required.

Root Cause

The root cause is the absence or improper verification of anti-CSRF nonces on sensitive Groundhogg request handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives for CSRF protection, and endpoints that omit these checks accept forged cross-origin requests. This is a textbook [CWE-352] weakness.

Attack Vector

Exploitation requires an attacker to lure an authenticated Groundhogg user to an attacker-controlled page or malicious link, typically through phishing, malvertising, or a comment injected on a trusted site. No credentials are needed by the attacker, but victim interaction is required. Because the attack vector is network based and the attacker never sees the response, this vulnerability is best suited to targeted actions rather than data exfiltration.

Refer to the Patchstack Groundhogg Plugin Vulnerability advisory for additional technical details.

Detection Methods for CVE-2024-37235

Indicators of Compromise

Unexpected changes to Groundhogg contacts, tags, funnels, or email campaigns without matching admin activity in audit logs.
HTTP POST requests to Groundhogg admin endpoints with Referer headers pointing to unrelated or attacker-controlled domains.
Authenticated WordPress sessions performing Groundhogg state changes immediately after visiting external links.

Detection Strategies

Enable and review the Groundhogg activity log alongside WordPress user activity plugins to correlate state changes with administrator sessions.
Deploy a web application firewall (WAF) rule that inspects requests to /wp-admin/admin.php?page=gh_* and /wp-admin/admin-ajax.php actions belonging to Groundhogg for missing or invalid _wpnonce parameters.
Alert on cross-origin Referer or Origin headers on state-changing Groundhogg requests.

Monitoring Recommendations

Forward WordPress access logs to a centralized log platform and alert on Groundhogg admin actions originating from external referrers.
Track the installed Groundhogg plugin version across all WordPress instances and flag any version at or below 3.4.2.3.
Monitor privileged user sessions for anomalous timing patterns between browsing activity and Groundhogg configuration changes.

How to Mitigate CVE-2024-37235

Immediate Actions Required

Upgrade Groundhogg to a version newer than 3.4.2.3 on every WordPress site where the plugin is installed.
Audit Groundhogg contacts, funnels, email templates, and integration settings for unauthorized modifications.
Force reauthentication for WordPress administrators and rotate any API keys managed through Groundhogg.

Patch Information

Adrian Tobey has addressed the CSRF weakness in Groundhogg releases published after version 3.4.2.3. Site operators should consult the Patchstack advisory for the specific fixed version and apply the update through the WordPress plugin manager or an equivalent deployment pipeline.

Workarounds

Restrict access to /wp-admin by source IP address using web server or reverse proxy access control lists until the plugin is upgraded.
Require administrators to use separate browser profiles or dedicated management workstations for WordPress sessions.
Deploy a WAF rule that blocks Groundhogg admin requests lacking a valid _wpnonce parameter or a same-origin Referer header.

bash

# Example ModSecurity rule to block cross-origin POSTs to Groundhogg endpoints
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,id:1004372350,deny,status:403,msg:'Blocked possible CVE-2024-37235 CSRF against Groundhogg'"
  SecRule REQUEST_URI "@rx /wp-admin/(admin\.php\?page=gh_|admin-ajax\.php)" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/" "t:none"