CVE-2026-104725 Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
Authenticated users with sales_rep access can escalate privileges to administrator by manipulating contact user links and generating auto-login URLs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104725?
CVE-2026-104725 is a high-severity vulnerability in trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation, published on 10 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the `user` parameter within the `process_edit()` function, which allows any authenticated user with the `edit_contacts` capability to reassign a contact record's linked WordPress user ID to any arbitrary account without requiring the `edit_users` or `promote_users` capabilities. This makes it possible for authenticated attackers, with sales_rep-level access and above, to escalate their privileges to administrator by linking a contact to an administrator's WordPress user ID, then creating a note containing the `{auto_login_link}` replacement tag to trigger generation of a valid auto-login permissions-key URL for the administrator-linked contact, and finally visiting that URL to authenticate as the targeted administrator. The auto-login URL is stored in the note content and is readable back by the attacker via the `view_notes` and `add_notes` capabilities that the sales_rep role holds by default.
Weakness: CWE-269
Which versions are affected by CVE-2026-104725?
How do I fix CVE-2026-104725?
No fix has been published for CVE-2026-104725 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104725 being exploited?
There is no known exploitation of CVE-2026-104725 in the wild and no public exploit code.
Sources
Also known as GHSA-p495-v7fq-hqr5.