CVE-2026-104725

8.8 HIGHpublic exploit available

Published 2026-10-10 · Updated 2026-10-13

AI risk analysis

Summary: The Groundhogg plugin allows authenticated users with edit_contacts capability to reassign any contact's WordPress user ID to another account, enabling privilege escalation to administrator level by linking contacts to admin accounts and using auto-login links in notes.
Exploitability: Easy to exploit for authenticated users with sales_rep-level access or higher, requiring only the ability to edit contacts and create notes with auto-login link tags.
Blast radius: High impact across all WordPress sites using Groundhogg plugin version 4.9 or earlier, potentially allowing attackers to gain full administrative control over targeted sites.
Detection: Monitor for unusual contact ownership changes in the wp_groundhogg_contacts table and note creation activities with {auto_login_link} tags, particularly from accounts with sales_rep or higher capabilities.
Prioritized remediation: Upgrade to version 4.10 or later which fixes the privilege escalation vulnerability.

privilege-escalationwordpresspluginauth-bypass

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the `user` parameter within the `process_edit()` function, which allows any authenticated user with the `edit_contacts` capability to reassign a contact record's linked WordPress user ID to any arbitrary account without requiring the `edit_users` or `promote_users` capabilities. This makes it possible for authenticated attackers, with sales_rep-level access and above, to escalate their privileges to administrator by linking a contact to an administrator's WordPress user ID, then creating a note containing the `{auto_login_link}` replacement tag to trigger generation of a valid auto-login permissions-key URL for the administrator-linked contact, and finally visiting that URL to authenticate as the targeted administrator. The auto-login URL is stored in the note content and is readable back by the attacker via the `view_notes` and `add_notes` capabilities that the sales_rep role holds by default.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

Public exploit & PoC references

https://github.com/groundhoggwp/groundhogg/commit/804abf42a

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.