Vulnerabilities / Groundhogg
Groundhogg vulnerabilities
Advisories WPSec published for Groundhogg — CRM, Newsletters, and Marketing Automation. Other sources may list more. Its attack surface: Groundhogg on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-14 | WPSEC-2026-0955 | Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via Contact File Copying | High 8.1 | 4.9.4 |
| 2026-10-11 | WPSEC-2026-0770 | Groundhogg <= 4.9.2 - Unauthenticated Insecure Direct Object Reference to Unsent and Private Broadcast Disclosure via Campaign Archive | Medium 5.3 | 4.9.3 |
| 2026-10-03 | WPSEC-2026-0368 | Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Authenticated (Subscriber+) Privilege Escalation via Support User Impersonation | High 7.1 | 4.9 |
License: CC BY 4.0