CVE-2026-97644

🗓️ 03 Oct 2026 03:25:44Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 39 Views🌐 WEB

Privilege escalation in Groundhogg for WordPress via Contact Identity Rebinding.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2026-97644	3 Oct 202605:34	–	circl
Cvelist	CVE-2026-97644 Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test	3 Oct 202603:25	–	cvelist
EUVD	EUVD-2026-91893	3 Oct 202603:25	–	euvd
NVD	CVE-2026-97644	3 Oct 202604:18	–	nvd
Patchstack	WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.9 - Authenticated (Sales Person+) Privilege Escalation vulnerability	2 Oct 202619:21	–	patchstack
Positive Technologies	PT-2026-104494	3 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-97644: Improper Privilege Management	3 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-97644 Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test	3 Oct 202603:25	–	vulnrichment

Vulners

Node

groundhogg groundhoggRange≤4.9wordpress

[
  {
    "vendor": "trainingbusinesspros",
    "product": "Groundhogg — CRM, Newsletters, and Marketing Automation",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.9",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/db/contacts.php
plugins	www.plugins.trac.wordpress.org/changeset/3724910/groundhogg/trunk/api/v3/contacts-api.php
plugins	www.plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/api/v3/contacts-api.php
plugins	www.plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/api/v4/emails-api.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/557306b7-7b66-465e-8d4d-ebae5b1577c9
plugins	www.plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/includes/main-roles.php
plugins	www.plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/includes/replacements.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/includes/rewrites.php

Parameter	Position	Path	Description	CWE
user_id	request body	gh/v3/contacts	Privilege Escalation via rebinding a contact's identity by sending a crafted payload to the v3 create_contact endpoint, which forwards user_id into upsert and bypasses ownership guards.	CWE-269

06 Oct 2026 15:04Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.18.8

EPSS0.00496

SSVC

CWE-269