Groundhogg (<= 4.8.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/groundhogg--4.8.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 10 Oct 2026 07:51:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrivilege Escalation in Groundhogg WordPress Plugin via CVE-2026-92975https://feed.craftedsignal.io/briefs/2026-10-groundhogg-priv-esc/Sat, 10 Oct 2026 07:51:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-groundhogg-priv-esc/The Groundhogg WordPress plugin is vulnerable to unauthorized privilege escalation due to insufficient validation of support user account credentials within the create_support_user() function.Groundhogg, a CRM and marketing automation plugin for WordPress, contains a high-severity privilege escalation vulnerability (CVE-2026-92975) affecting versions 4.8.3 and earlier. The flaw resides in the create_support_user() function, which attempts to identify a support-authorized account by checking if a user's user_login matches the hardcoded string 'groundhogg' and if their email matches 'support@groundhogg.io' or 'help@groundhogg.io'. Because the plugin fails to properly validate these attributes against a secure identity provider, an attacker who registers a standard account with the username 'groundhogg' and sets their email address to one of the hardcoded support constants can be automatically promoted to administrator. This promotion occurs when a legitimate site administrator interacts with the plugin's support access functionality. If the triggering administrator possesses manage_network_options privileges in a multisite environment, the attacker may also be granted super admin status, leading to full site takeover.

Impact

Successful exploitation allows a low-privileged user to obtain administrative access to the WordPress instance. This results in the potential for complete site compromise, including the ability to execute arbitrary code, modify site content, exfiltrate sensitive CRM data, and install persistent backdoors. This vulnerability impacts all organizations running Groundhogg versions up to and including 4.8.3.

Recommendation

  1. Upgrade the Groundhogg plugin to the latest patched version immediately.
  2. Audit existing user accounts for the username 'groundhogg' and the specified hardcoded email addresses.
  3. Restrict or disable open user registration on WordPress instances where the plugin is active to prevent the initial account creation required for exploitation.
]]>highadvisory