CVE-2026-97644

Name of the Vulnerable Software and Affected Versions Groundhogg — CRM, Newsletters, and Marketing Automation versions prior to 5.0

Description Privilege escalation is possible through contact identity rebinding. The create contact function in the POST /gh/v3/contacts endpoint is only protected by the add contacts capability and forwards the entire request payload, including the user id variable, to the Contacts DB::add() function. This process bypasses the ownership guard used in Contacts DB::update(), allowing authenticated users with Sales Representative-level access or higher to rebind a contact record to an Administrator's user ID. Subsequently, an attacker can use the POST /gh/v4/emails/test endpoint, which is accessible via the send emails capability, to generate an {auto login url}. This one-time permissions key allows the attacker to call wp set auth cookie() and obtain a fully authenticated session as a WordPress Administrator.

Recommendations Update Groundhogg — CRM, Newsletters, and Marketing Automation to version 5.0 or later.