Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Authenticated (Subscriber+) Privilege Escalation via Support User Impersonation
- ID
- WPSEC-2026-0368
- Plugin
- Groundhogg — CRM, Newsletters, and Marketing Automation (groundhogg)
- Affected
- from 2.6.2 before 4.9
- Remediation
- Update to 4.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Groundhogg — CRM, Newsletters, and Marketing Automation on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-92975, on 2026-10-09.
Description
The Groundhogg plugin for WordPress is vulnerable to Privilege Escalation in versions 2.6.2 up to, and including, 4.8.3. When an administrator grants Groundhogg support access (a support ticket with admin access, or sending support access from the Help page), the plugin identifies its support account only by the username 'groundhogg' and an email address of [email protected] or [email protected], and then gives that account the administrator role (super admin on multisite when a network administrator grants access). Both values can be set by a user on their own account, so an authenticated attacker with subscriber-level access whose account uses that username and email gains administrator access once an administrator grants support access. Versions before 2.6.3.6 matched on the email address alone.
References
- https://wpsec.com/vuln/WPSEC-2026-0368/
- https://plugins.svn.wordpress.org/groundhogg/tags/4.9/
- https://wordpress.org/plugins/groundhogg/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS