CVE-2026-92975

The Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress (versions ≤ 4.8.3 ) contains a Privilege Escalation vulnerability in the create_support_user() function. The flaw exists because the function identifies support accounts using publicly hardcoded constants—specifically ...

EUVD-2026-96105

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...

CVE-2026-92975: Improper Privilege Management

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...

helpdeskz-file-upload-poc

HelpDeskZ File Upload RCE An unauthenticated arbitrary fil...

CVE-2023-2715: Missing Authorization

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's...