Privilege Escalation in Groundhogg — CRM, Newsletters, and Marketing Automation (WordPress plugin) (CVE-2026-97644)
Summary
Vulnerability in Groundhogg — CRM, Newsletters, and Marketing Automation (WordPress plugin) (CVE-2026-97644). Successful exploitation can lead to full system takeover. Exploitable via POST /gh/v3/contacts.
Original description
The description as published by the source.
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the create_contact function in the v3 REST endpoint (POST /gh/v3/contacts) is gated solely by the add_contacts capability and forwards the full request payload — including the security-bearing user_id column — into the upsert path of Contacts_DB::add(), which bypasses the ownership guard that Contacts_DB::update() enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (POST /gh/v4/emails/test) — also accessible to the Sales Representative role via the send_emails capability — to generate an {auto_login_url} one-time permissions key bound to the rebound contact, and consume that link to call wp_set_auth_cookie() and gain a fully authenticated session as the WordPress Administrator.
Source: NIST National Vulnerability Database NVD GitHub Advisory
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
The Groundhogg - CRM、ニュースレター、およびマーケティングオートメーションプラグインのWordPressにおける全バージョン4.9以下に特権昇格の脆弱性があります。この脆弱性により、攻撃者はSales Representativeレベルのユーザー権限を利用して、管理者としてのセッションを取得することができます。
WordPressのGroundhoggプラグインに特権昇格の脆弱性があります。
全バージョン4.9以下のGroundhoggプラグインにおいて
攻撃者は管理者権限を持つセッションを取得できるため、深刻です。
プラグインを4.9.1以上に更新します。
権限の厳格管理と信頼できるユーザのみのアクセスを許可する。
Sales Representative権限のユーザの活動を監視し、異常を検出します。