{"schema":"threatline.record/2","record":{"id":"CVE-2026-97644","aliases":[],"summary":"Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test","details":"The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator.","categories":["Unclassified"],"product":"Groundhogg — CRM, Newsletters, and Marketing Automation","vendor":"trainingbusinesspros","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97644","source_modified_at":"2026-10-03T15:42:46.419Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Groundhogg — CRM, Newsletters, and Marketing Automation","vendor":"trainingbusinesspros","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00496,"percentile":0.41689,"score_date":"2026-10-23"},"published_at":"2026-10-03T03:25:44.527Z","modified_at":"2026-10-03T15:42:46.419Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97644","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-03T15:42:46.419Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97644","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/557306b7-7b66-465e-8d4d-ebae5b1577c9?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/api/v3/contacts-api.php#L373"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/db/contacts.php#L205"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/api/v4/emails-api.php#L571"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/includes/replacements.php#L2280"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/includes/rewrites.php#L460"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.3/includes/main-roles.php#L532"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3724910%40groundhogg%2Ftags%2F4.9.1&old=3724058%40groundhogg%2Ftags%2F4.9"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3724910/groundhogg/trunk/api/v3/contacts-api.php"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-03T15:33:36.949763Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-03T15:42:46.419Z","content_hash":"4a78a0160fba1d8c659df0b49b5522bb8e32ee0b682f0d69da41028585709a2c"}}