https://vulnerability.circl.lu/sightings/feed 2026-10-10T19:22:31.493854+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a48e3f28-8afe-4203-b915-3d340d6bb432/export 2026-10-10T19:22:31.516951+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a48e3f28-8afe-4203-b915-3d340d6bb432", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92975", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415067912817733", "content": "CVE-2026-92975 Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by matching against publicly hardcoded constants \u2014 `user_login` `'groundhogg'` and email addresses `'support@groundhogg.io'` / `'help@groundhogg.io'` \u2014 where the `in_array()` email-equality check at line 238 is not a security boundary because any user fully controls their own email value. This makes it possible for an attacker with an account whose `user_login` is `'groundhogg'` and whose `user_email` matches one of the hardcoded support constants to have that account silently promoted to administrator \u2014 and additionally to super admin on multisite when the triggering administrator holds `manage_network_options` \u2014 resulting in full site takeover. Exploitation requires a two-actor flow: the attacker must first obtain or pre-plant an account with the hardcoded credentials (possible when open user registration is enabled or another account-creation path exists), after which a legitimate administrator must invoke the support-access feature via the `submit_ticket` or `process_send_support_access` entry points to trigger the promotion.\nhttps://www.cve.org/CVERecord?id=CVE-2026-92975https://www.wordfence.com/threat-intel/vulnerabilities/id/c355658a-515a-48ed-a114-6a202e23e34b?source=cvehttps://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.1/admin/help/help-page.php#L250https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.1/admin/help/help-page.php#L224https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.1/admin/help/help-page.php#L238https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.1/admin/help/help-page.php#L298https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.1/admin/help/help-page.php#L599https://github.com/groundhoggwp/groundhogg/commit/4b413aa6e#wordpress #trainingbusinesspros #Groundhogg\u2014CRM,Newsletters,andMarketingAutomation#CVE_2026_92975#bot", "creation_timestamp": "2026-10-10T05:55:55.062459Z"} 2026-10-10T05:55:55.062459+00:00