CVE-2026-97644

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: Wordfence

Description

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-97644

EUVD

EUVD-2026-91893

Affected Vendors & Products

Vendor	Product	Version / Range
trainingbusinesspros	Groundhogg	— CRM, Newsletters, and Marketing Automation 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability allows authenticated attackers with Sales Representative-level access or higher to escalate their privileges to an Administrator account. The flaw exists in the Groundhogg WordPress plugin where an attacker can modify a contact record to link it to an Administrator's user ID. This is done by exploiting a function that bypasses ownership checks, then generating a one-time login link for the rebound contact to gain full admin access.

Detection Guidance

This vulnerability can be detected by checking for unauthorized privilege escalation attempts in WordPress logs. Look for POST requests to /gh/v3/contacts or /gh/v4/emails/test endpoints with suspicious user_id rebinding. Review WordPress user roles for unexpected Administrator-level access changes.

Impact Analysis

If exploited, this vulnerability could allow an attacker to take full control of your WordPress site as an Administrator. This means they could install malicious plugins, steal data, deface your website, or use your site to launch further attacks. The impact is severe as it grants complete administrative privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. A breach could result in legal penalties, loss of trust, and significant financial consequences due to non-compliance with these regulations.

Mitigation Strategies

Update the Groundhogg plugin to the latest version beyond 4.9 to patch the privilege escalation vulnerability. If an update is not immediately available, disable the plugin or restrict access to the vulnerable REST endpoints for non-admin users.

Hi! I’m here to help you understand CVE-2026-97644. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70