CVE-2026-97644

8.8 HIGH

Published 2026-10-03 · Updated 2026-10-06

AI risk analysis

Summary: The Groundhogg plugin for WordPress allows attackers with Sales Representative-level access to escalate privileges by reassigning contact records to an Administrator's user ID, then using an email test feature to gain full admin access.
Exploitability: Exploitation requires an attacker to have Sales Representative-level access and involves reassigning a contact record and using an email test feature, making it moderately difficult.
Blast radius: If exploited, this vulnerability could result in full administrative control over the WordPress instance, potentially leading to data theft, system compromise, and broader network security issues.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Groundhogg version 5.0.0 or later.

auth-bypasswebprivilege-escalation

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.