CVE-2026-97644
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to privilege escalation via contact identity rebinding. The create_contact function in the v3 REST endpoint is gated only by the add_contacts capability and forwards the full payload, including user_id, to the upsert path, bypassing ownership guards. This allows attackers with Sales Representative-level access and above to rebind a contact to an Administrator's user ID and then use the v4 email-test endpoint to gain an admin session.
Risk Assessment
Risk includes full takeover of a WordPress administrator account, potentially leading to complete site and data compromise.
Recommendation
It is recommended to immediately update the Groundhogg plugin to a version newer than 4.9 and restrict user role permissions.
Other vulnerabilities in Groundhogg
See all- CVE-2026-109221High
The Groundhogg plugin for WordPress (versions up to and including 4.9.3) is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function. An authenticated attacker with Sales Representative-level access or above can delete arbitrary files on the server, which can easily lead to remote code execution.
- CVE-2026-18548High
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-92975High
The Groundhogg plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 4.8.3. The create_support_user() function identifies the support account solely by matching against publicly hardcoded constants, allowing an attacker with an account having login 'groundhogg' and matching email to be promoted to administrator, and to super admin on multisite.
- CVE-2026-104725High
The Groundhogg plugin for WordPress up to version 4.9 is vulnerable to privilege escalation. Missing ownership and capability checks in the 'process_edit()' function allow authenticated users with 'edit_contacts' capability (e.g., sales reps) to reassign a contact to any WordPress account, including an administrator, and then use the auto-login URL to authenticate as that administrator.
- CVE-2026-104385High
Groundhogg plugin in versions up to and including 4.8.3 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-104408High
The Groundhogg plugin for WordPress (versions up to 4.8.3) contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands.
- CVE-2026-85310Medium
import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
- CVE-2026-81741Medium
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before version 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.
- CVE-2026-81660High
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing and outputting them in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users.
- CVE-2026-18387Medium
The Groundhogg plugin for WordPress up to version 4.5.14 is vulnerable to SQL injection via the tag_query parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with vendor-level access to append additional SQL queries, potentially extracting sensitive information. Exploitation requires triggering the Legacy_Contact_Query code path via an unknown filter type.
Original NVD description (English source)
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS