CVE-2026-92975
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The Groundhogg plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 4.8.3. The create_support_user() function identifies the support account solely by matching against publicly hardcoded constants, allowing an attacker with an account having login 'groundhogg' and matching email to be promoted to administrator, and to super admin on multisite.
Risk Assessment
The risk includes full site takeover, including content modification, data theft, and malware installation. However, the attack requires an administrator to invoke the support feature.
Recommendation
Update the Groundhogg plugin to the latest version. Also change the support account identification method to not rely on public constants.
Other vulnerabilities in Groundhogg
See all- CVE-2026-104725High
The Groundhogg plugin for WordPress up to version 4.9 is vulnerable to privilege escalation. Missing ownership and capability checks in the 'process_edit()' function allow authenticated users with 'edit_contacts' capability (e.g., sales reps) to reassign a contact to any WordPress account, including an administrator, and then use the auto-login URL to authenticate as that administrator.
- CVE-2026-104385High
Groundhogg plugin in versions up to and including 4.8.3 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-104408High
The Groundhogg plugin for WordPress (versions up to 4.8.3) contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands.
- CVE-2026-97644High
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to privilege escalation via contact identity rebinding. The create_contact function in the v3 REST endpoint is gated only by the add_contacts capability and forwards the full payload, including user_id, to the upsert path, bypassing ownership guards. This allows attackers with Sales Representative-level access and above to rebind a contact to an Administrator's user ID and then use the v4 email-test endpoint to gain an admin session.
- CVE-2026-85310Medium
import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
- CVE-2026-81741Medium
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before version 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.
- CVE-2026-81660High
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing and outputting them in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users.
- CVE-2026-18387Medium
The Groundhogg plugin for WordPress up to version 4.5.14 is vulnerable to SQL injection via the tag_query parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with vendor-level access to append additional SQL queries, potentially extracting sensitive information. Exploitation requires triggering the Legacy_Contact_Query code path via an unknown filter type.
- CVE-2026-11454Medium
The Groundhogg plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.5.2. The REST endpoint GET /wp-json/gh/v4/contacts/<id> only checks the view_contacts capability, not view_others_contacts, allowing authenticated attackers (e.g., Sales Rep role) to read any contact record, including PII, contact meta, owner IDs, admin edit URLs, and full capability sets of linked WordPress users.
- CVE-2026-57389High
The Groundhogg WordPress plugin up to version 4.4.1 contains a Path Traversal vulnerability that allows unauthorized access to files outside the restricted directory.
Original NVD description (English source)
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by matching against publicly hardcoded constants — `user_login` `'groundhogg'` and email addresses `'[email protected]'` / `'[email protected]'` — where the `in_array()` email-equality check at line 238 is not a security boundary because any user fully controls their own email value. This makes it possible for an attacker with an account whose `user_login` is `'groundhogg'` and whose `user_email` matches one of the hardcoded support constants to have that account silently promoted to administrator — and additionally to super admin on multisite when the triggering administrator holds `manage_network_options` — resulting in full site takeover. Exploitation requires a two-actor flow: the attacker must first obtain or pre-plant an account with the hardcoded credentials (possible when open user registration is enabled or another account-creation path exists), after which a legitimate administrator must invoke the support-access feature via the `submit_ticket` or `process_send_support_access` entry points to trigger the promotion.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS