Filtered by vendor Wordpress-extensions Subscriptions
Filtered by product Groundhogg Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-92975 2 Trainingbusinesspros, Wordpress-extensions 2 Groundhogg — Crm, Newsletters, And Marketing Automation, Groundhogg 2026-10-19 8.1 High
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by matching against publicly hardcoded constants — `user_login` `'groundhogg'` and email addresses `'[email protected]'` / `'[email protected]'` — where the `in_array()` email-equality check at line 238 is not a security boundary because any user fully controls their own email value. This makes it possible for an attacker with an account whose `user_login` is `'groundhogg'` and whose `user_email` matches one of the hardcoded support constants to have that account silently promoted to administrator — and additionally to super admin on multisite when the triggering administrator holds `manage_network_options` — resulting in full site takeover. Exploitation requires a two-actor flow: the attacker must first obtain or pre-plant an account with the hardcoded credentials (possible when open user registration is enabled or another account-creation path exists), after which a legitimate administrator must invoke the support-access feature via the `submit_ticket` or `process_send_support_access` entry points to trigger the promotion.
CVE-2026-104725 2 Trainingbusinesspros, Wordpress-extensions 2 Groundhogg — Crm, Newsletters, And Marketing Automation, Groundhogg 2026-10-19 8.8 High
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the `user` parameter within the `process_edit()` function, which allows any authenticated user with the `edit_contacts` capability to reassign a contact record's linked WordPress user ID to any arbitrary account without requiring the `edit_users` or `promote_users` capabilities. This makes it possible for authenticated attackers, with sales_rep-level access and above, to escalate their privileges to administrator by linking a contact to an administrator's WordPress user ID, then creating a note containing the `{auto_login_link}` replacement tag to trigger generation of a valid auto-login permissions-key URL for the administrator-linked contact, and finally visiting that URL to authenticate as the targeted administrator. The auto-login URL is stored in the note content and is readable back by the attacker via the `view_notes` and `add_notes` capabilities that the sales_rep role holds by default.
CVE-2026-109221 2 Trainingbusinesspros, Wordpress-extensions 2 Groundhogg — Crm, Newsletters, And Marketing Automation, Groundhogg 2026-10-17 8.1 High
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.
CVE-2026-104385 2 Adrian Tobey, Wordpress-extensions 2 Groundhogg, Groundhogg 2026-10-06 7.5 High
Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.