IT SBIT Services
Schneeberger
DEEN
CVE tracker

Groundhogg: Privilege escalation to administrator via contact identity rebinding

CVE-2026-97644High 8.8

← All vulnerabilities

Summary

The Groundhogg CRM and marketing automation plugin for WordPress, up to and including version 4.9, has an authorization flaw in its contact REST API. An authenticated user with Sales Representative access or higher can link a contact record to an administrator's WordPress user ID and then generate a one-time login link for it. Using that link, the attacker gains a full administrator session on the website.

Affected

  • Groundhogg (trainingbusinesspros) up to and including 4.9
  • Versions above 4.9: unknown

Fixed in

Unknown. A fixed version could not be confirmed from the sources available.

Workaround

  • No vendor workaround known.
  • Limit the Sales Representative and similar roles to users who need them.
  • Review contact records for links to administrator accounts.

Exploitation

  • No public exploit known.
  • Not listed in the CISA KEV catalog; no in-the-wild use known.
  • CISA SSVC: exploitation none, not automatable.
  • EPSS score 0.00496 (low).

Our recommendation

  • Check whether Groundhogg is installed and which version is active; treat version 4.9 or earlier as vulnerable.
  • Update as soon as the vendor confirms a fixed version.
  • Until then, review accounts with the Sales Representative role and their contact-creation and email-sending rights.
  • Check administrator accounts and active sessions for unexpected changes and monitor for unusual administrator logins.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:41.

Original description (NVD)

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator.

NVD references (9)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed