CVE-2026-92975

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the create support user() function. This is due to the function identifying the support account solely by matching against publicly hardcoded constants — user login 'groundhogg' and email addresses 'support@groundhogg.io' / 'help@groundhogg.io' — where the in array() email-equality check at line 238 is not a security boundary because any user fully controls their own email value. This makes it possible for an attacker with an account whose user login is 'groundhogg' and whose user email matches one of the hardcoded support constants to have that account silently promoted to administrator — and additionally to super admin on multisite when the triggering administrator holds manage network options — resulting in full site takeover. Exploitation requires a two-actor flow: the attacker must first obtain or pre-plant an account with the hardcoded credentials (possible when open user registration is enabled or another account-creation path exists), after which a legitimate administrator must invoke the support-access feature via the submit ticket or process send support access entry points to trigger the promotion.