Skip to content
Threat Feed
Subscribe

Product

Groundhogg — CRM, Newsletters, and Marketing Automation (<= 4.9)

1 brief RSS
high advisory

Privilege Escalation in Groundhogg WordPress Plugin via Contact Rebinding

Authenticated attackers can perform privilege escalation in Groundhogg versions 4.9 and below by rebinding contact records to arbitrary user IDs via the REST API and leveraging automated login links.

Groundhogg — CRM, Newsletters, and Marketing Automation privilege-escalation wordpress web-application
1r 1t 1c