Groundhogg WordPress plugin: Privilege escalation via contact user link
Summary
The Groundhogg WordPress plugin up to and including version 4.9 lets an authenticated user with contact-editing rights (sales_rep and above) link a contact to any WordPress account, including an administrator. By creating a note with the auto-login replacement tag and reading the generated auto-login URL, the attacker can sign in as the administrator. The attack requires a valid low-privileged account on the WordPress site.
Affected
- Groundhogg plugin for WordPress, all versions up to and including 4.9
Fixed in
- Upgrade to Groundhogg 4.9.1 or later (the current 4.9.x release is recommended)
Workaround
- Unknown. No workaround is documented; apply the update.
Exploitation
- Not marked as known exploited in the sources reviewed.
- Public proof of concept: Unknown.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
Our recommendation
- Update Groundhogg to version 4.9.1 or later without delay.
- Review accounts with sales or contact-editing roles and remove unneeded ones.
- Check administrator accounts and contacts linked to administrator accounts for unexpected changes or logins.
- Limit the edit_contacts capability to staff who need it.
- Also check related CVE-2026-97644, which is fixed in the same release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-104725 Wordfence advisory www.wordfence.com
- Groundhogg fix commit 804abf42a github.com
- Groundhogg 4.9 to 4.9.1 changeset plugins.trac.wordpress.org
- OSV CVE-2026-104725 osv.dev
- OpenCVE CVE-2026-104725 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:50.
Original description (NVD)
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the `user` parameter within the `process_edit()` function, which allows any authenticated user with the `edit_contacts` capability to reassign a contact record's linked WordPress user ID to any arbitrary account without requiring the `edit_users` or `promote_users` capabilities. This makes it possible for authenticated attackers, with sales_rep-level access and above, to escalate their privileges to administrator by linking a contact to an administrator's WordPress user ID, then creating a note containing the `{auto_login_link}` replacement tag to trigger generation of a valid auto-login permissions-key URL for the administrator-linked contact, and finally visiting that URL to authenticate as the targeted administrator. The auto-login URL is stored in the note content and is readable back by the attacker via the `view_notes` and `add_notes` capabilities that the sales_rep role holds by default.
NVD references (8)
- https://github.com/groundhoggwp/groundhogg/commit/804abf42a
- https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/admin/contacts/contacts-page.php#L507
- https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/admin/contacts/contacts-page.php#L565
- https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/includes/classes/note.php#L58
- https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/includes/replacements.php#L1811
- https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/includes/rewrites.php#L471
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3724910%40groundhogg%2Ftags%2F4.9.1&old=3724058%40…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/715b4d10-b19a-4b37-8a76-985c37975c93?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.