CVE-2026-97644: Groundhogg WordPress Plugin Privilege Escalation

CVE-2026-97644 Overview

CVE-2026-97644 is a privilege escalation vulnerability in the Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress, affecting all versions up to and including 4.9. The flaw allows authenticated attackers with Sales Representative-level access or above to rebind an existing contact record to an Administrator's WordPress user ID. Attackers can then abuse the plugin's email-test endpoint to generate an auto-login URL that produces an authenticated Administrator session. The weakness is classified under CWE-269: Improper Privilege Management.

Critical Impact
A low-privileged Sales Representative can obtain a fully authenticated WordPress Administrator session, enabling full site takeover.

Affected Products

Groundhogg plugin for WordPress — all versions up to and including 4.9
Groundhogg v3 REST API endpoint POST /gh/v3/contacts
Groundhogg v4 REST API endpoint POST /gh/v4/emails/test

Discovery Timeline

2026-10-03 - CVE-2026-97644 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-97644

Vulnerability Analysis

The vulnerability chains two authorization gaps in the Groundhogg plugin to escalate from a Sales Representative role to WordPress Administrator. The create_contact function in the v3 REST endpoint is gated solely by the add_contacts capability. It forwards the full request payload, including the security-bearing user_id column, into the upsert path of Contacts_DB::add().

That upsert path bypasses the ownership guard enforced by Contacts_DB::update(). As a result, an attacker can rebind any existing contact record to an arbitrary WordPress user ID, including an Administrator account. The attacker then calls the v4 email-test endpoint, which is available to the Sales Representative role via the send_emails capability, to render an {auto_login_url} replacement token for the rebound contact.

Consuming the generated one-time permissions key invokes wp_set_auth_cookie() and issues a session for the Administrator user tied to the rebound record. The attack requires network access and low privileges, but no user interaction.

Root Cause

The root cause is improper privilege management [CWE-269] in Contacts_DB::add(). The upsert branch accepts caller-supplied fields such as user_id without validating whether the authenticated principal owns the target contact or is permitted to assign the specified user association. The add_contacts capability check does not substitute for an ownership or role boundary check on the user_id field.

Attack Vector

An authenticated attacker holding the Sales Representative role or higher sends a crafted POST /gh/v3/contacts request that specifies both the attacker's existing contact email and an Administrator's user_id. The upsert rebinds the record. The attacker then issues POST /gh/v4/emails/test with a template containing {auto_login_url}, receives the email body with the signed login link, and follows it to establish an Administrator session.

See the Groundhogg contacts API source, the emails API source, and the auto-login rewrite handler for the vulnerable code paths. No verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-97644

Indicators of Compromise

POST requests to /wp-json/gh/v3/contacts from non-Administrator accounts that include a user_id field in the JSON body.
POST requests to /wp-json/gh/v4/emails/test where the referenced template contains the {auto_login_url} replacement token.
Successful WordPress authentication cookies issued to Administrator accounts shortly after a /gh/v4/emails/test call from a lower-privileged session.
Contact records in the Groundhogg contacts table whose user_id column was recently reassigned to an Administrator account.

Detection Strategies

Inspect web server and WordPress REST logs for the two-endpoint sequence gh/v3/contacts followed by gh/v4/emails/test from the same session or IP within a short window.
Audit the Groundhogg contacts database table for rows where user_id points to a user with the administrator role but owner_id is a Sales Representative or Marketer.
Alert on outbound test emails whose rendered body contains auto_login URLs pointing at Administrator accounts.

Monitoring Recommendations

Forward WordPress REST API access logs and the Groundhogg database audit trail to a centralized log platform for correlation.
Monitor new wp_set_auth_cookie sessions for Administrator users and correlate them with the originating request path.
Track role and capability changes on WordPress user accounts and flag any Administrator session originating from an auto-login link.

How to Mitigate CVE-2026-97644

Immediate Actions Required

Update the Groundhogg plugin to version 4.9.1 or later, which contains the fix referenced in changeset 3724910.
Review all WordPress user accounts assigned the Sales Representative or Marketer roles and remove any that are not required.
Invalidate active WordPress sessions and rotate credentials for Administrator accounts if exploitation is suspected.
Audit the Groundhogg contacts table for records whose user_id was reassigned to an Administrator user.

Patch Information

The vendor fixed the issue in Groundhogg 4.9.1. The changeset comparison between 4.9 and 4.9.1 shows the hardening applied to the v3 contacts API. Additional details are documented in Wordfence Vulnerability ID 557306.

Workarounds

Restrict access to the /wp-json/gh/v3/contacts and /wp-json/gh/v4/emails/test endpoints with a web application firewall rule until the plugin is updated.
Temporarily remove the add_contacts and send_emails capabilities from the Sales Representative and Marketer roles if the plugin cannot be upgraded immediately.
Disable the Groundhogg plugin on production sites until version 4.9.1 or later is deployed.

bash

# Example WP-CLI commands to remove the vulnerable capabilities from lower-privileged Groundhogg roles
wp cap remove sales_representative add_contacts
wp cap remove sales_representative send_emails
wp cap remove marketer add_contacts
wp cap remove marketer send_emails