Authenticated attackers can perform privilege escalation in Groundhogg versions 4.9 and below by rebinding contact records to arbitrary user IDs via the REST API and leveraging automated login links.
Groundhogg — CRM, Newsletters, and Marketing Automation
privilege-escalation
wordpress
web-application
1r
1t
1c