CVE-2026-104725: Groundhogg WordPress Plugin Privilege Escalation

CVE-2026-104725 Overview

The Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress contains a privilege escalation vulnerability in all versions up to and including 4.9. The flaw resides in the process_edit() function, which lacks ownership and capability checks on the user parameter. Authenticated users with the edit_contacts capability can reassign a contact record's linked WordPress user ID to any arbitrary account, including administrators. By chaining this with the plugin's {auto_login_link} replacement tag, attackers holding sales_rep role or higher can generate and retrieve a valid auto-login URL for an administrator account. This issue is tracked under [CWE-269: Improper Privilege Management].

Critical Impact
Authenticated attackers with sales_rep-level access can escalate to full administrator privileges on the WordPress site, leading to complete site compromise.

Affected Products

Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress
All versions up to and including 4.9
Fixed in version 4.9.1

Discovery Timeline

2026-10-10 - CVE-2026-104725 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104725

Vulnerability Analysis

The vulnerability exists in the Groundhogg contact editing workflow. When a contact record is saved through process_edit() in admin/contacts/contacts-page.php, the handler accepts a user_id parameter that defines which WordPress user the contact is linked to. The plugin fails to verify that the current actor is permitted to perform user-linking operations before writing the value to the database.

Attackers can abuse the {auto_login_link} replacement tag defined in includes/replacements.php. This tag generates a signed permissions-key URL that logs the visitor in as the WordPress user linked to the contact. Because the sales_rep role holds view_notes and add_notes by default, the attacker can store the rendered link inside a contact note and read it back directly, completing the escalation chain.

Root Cause

The root cause is a missing capability check. The process_edit() function treats the edit_contacts capability as sufficient to modify the linked WordPress user ID, when the operation actually requires edit_users or promote_users. No ownership validation enforces that the targeted user ID belongs to the contact owner or a subordinate account.

Attack Vector

Exploitation requires an authenticated session with sales_rep role or higher. The attacker edits an attacker-controlled contact, sets its user_id to the WordPress ID of an administrator, creates a note containing the {auto_login_link} tag, then reads the stored note to obtain the auto-login URL. Visiting the URL authenticates the attacker as the targeted administrator.

php

// Security patch in includes/classes/contact.php
// Stop a contact editor from signing in as another user (CVE-2026-104725)

			}
		}

	unset( $value );

	// Linking a contact to a WP user decides whose account its auto-login links sign in as,
	// so it can't be left to anyone who is merely allowed to edit contacts.
	if ( isset( $data['user_id'] ) && ! can_link_contact_to_user( $data['user_id'] ) ) {
		unset( $data['user_id'] );
	}

	return $data;
	}

Source: GitHub Commit 804abf42a. The patch introduces a can_link_contact_to_user() guard that strips the user_id field when the current actor lacks authority to link the targeted account.

Detection Methods for CVE-2026-104725

Indicators of Compromise

Contact records whose user_id field was changed to a WordPress user ID belonging to an administrator or editor.
Notes created on contact records that contain the literal string {auto_login_link} or rendered URLs containing the auto_login permissions-key parameter.
WordPress login events for administrator accounts originating from the permissions-key auto-login endpoint without a prior password authentication event.
New administrator accounts, plugin installations, or theme modifications shortly after a sales_rep user activity window.

Detection Strategies

Audit the groundhogg_contacts table for recent user_id reassignments mapped to privileged WordPress users.
Review the groundhogg_notes table for note content referencing the {auto_login_link} replacement tag or rendered permissions-key URLs.
Correlate web server access logs for requests to the auto-login rewrite endpoint defined in includes/rewrites.php with the subsequent session fixation of administrator cookies.

Monitoring Recommendations

Enable WordPress audit logging on user role changes, plugin installations, and administrator logins.
Alert on any non-administrator role creating or modifying contact records whose linked user ID resolves to an administrator capability.
Monitor outbound email and note activity from sales_rep accounts for template tags that generate authenticated URLs.

How to Mitigate CVE-2026-104725

Immediate Actions Required

Update the Groundhogg plugin to version 4.9.1 or later immediately on all WordPress sites where it is installed.
Review all WordPress administrator accounts for unauthorized logins and rotate credentials for any potentially compromised accounts.
Audit all contacts with linked WordPress user IDs and remove unexpected links to privileged accounts.
Delete any notes containing {auto_login_link} content that cannot be attributed to a legitimate workflow.

Patch Information

The vendor released a fix in Groundhogg 4.9.1. The remediation is published as WordPress Trac Changeset 3724910 and in the upstream GitHub commit 804abf42a. Additional analysis is available in the Wordfence Vulnerability Report.

Workarounds

Temporarily restrict the sales_rep role and remove the edit_contacts capability from non-trusted users until the plugin is patched.
Revoke add_notes and view_notes from lower-privileged roles to prevent retrieval of generated auto-login URLs.
Disable the Groundhogg plugin on exposed sites that cannot be upgraded immediately.

bash

# Verify installed Groundhogg version and update via WP-CLI
wp plugin get groundhogg --field=version
wp plugin update groundhogg --version=4.9.1