CVE-2026-104725

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-104725

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104725.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-104725

Published

2026-10-10T05:30:59Z

Modified

2026-10-11T02:46:16Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter

Details

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the process_edit() function, which allows any authenticated user with the edit_contacts capability to reassign a contact record's linked WordPress user ID to any arbitrary account without requiring the edit_users or promote_users capabilities. This makes it possible for authenticated attackers, with sales_rep-level access and above, to escalate their privileges to administrator by linking a contact to an administrator's WordPress user ID, then creating a note containing the {auto_login_link} replacement tag to trigger generation of a valid auto-login permissions-key URL for the administrator-linked contact, and finally visiting that URL to authenticate as the targeted administrator. The auto-login URL is stored in the note content and is readable back by the attacker via the view_notes and add_notes capabilities that the sales_rep role holds by default.

Database specific

{
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-269"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104725.json"
}

References

Affected packages

Git / github.com/groundhoggwp/groundhogg

Affected ranges

Type

GIT

Repo

https://github.com/groundhoggwp/groundhogg

Events

Introduced

Fixed

804abf42a

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.9"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104725.json"