# CVE-2026-104725: Groundhogg privilege escalation via contact user reassignment

Source: https://junglewise.ai/threats/cve-2026-104725-the-groundhogg-crm-newsletters-and-marketing-automation-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-104725 · Severity: high · CVSS 8.8 · Published 2026-10-10

Groundhogg is a WordPress plugin that manages customer contacts, marketing automation, and newsletters. A flaw allows authenticated users with basic sales representative access to escalate their privileges to administrator by reassigning a contact to an administrator account, then using an auto-login feature to access that account. This gives attackers full control of the WordPress site.

Technologies: [Groundhogg — CRM, Newsletters, and Marketing Automation](https://junglewise.ai/threats/technologies/groundhogg-crm-newsletters-and-marketing-automation). Vendors: [Groundhogg](https://junglewise.ai/threats/vendors/groundhogg).

## Quick answers

**Is CVE-2026-104725 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104725 being exploited in the wild.

**How severe is CVE-2026-104725?** High severity, with a CVSS score of 8.8, published 10 October 2026.

**Which products and versions are affected?** Groundhogg — CRM, Newsletters, and Marketing Automation up to and including 4.9.

**Is there a fix for CVE-2026-104725?** Yes: fixed in 4.10 and later (fix commit 804abf42a adds ownership and capability checks on the user parameter and restricts auto-login link generation). Until then: Restrict the `edit_contacts` capability to trusted users only and monitor contact reassignment activity until the plugin is updated. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104725 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-104725?** Check whether you run Groundhogg — CRM, Newsletters or and Marketing Automation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.10 and later (fix commit 804abf42a adds ownership and capability checks on the user parameter and restricts auto-login link generation)

Restrict the `edit_contacts` capability to trusted users only and monitor contact reassignment activity until the plugin is updated.

## Technical details

The plugin's `process_edit()` function in the contact editing workflow fails to check whether the authenticated user has permission to link a contact to a specific WordPress user ID, allowing any user with the `edit_contacts` capability to reassign contacts arbitrarily. An attacker with sales_rep-level access can link a contact to an administrator account, generate a valid auto-login URL via the `{auto_login_link}` replacement tag in a contact note, and use that URL to authenticate as the target administrator without requiring `edit_users` or `promote_users` capabilities.

## Affected products

- Groundhogg Groundhogg — CRM, Newsletters, and Marketing Automation up to and including 4.9

## Timeline

- 2026-10-10: disclosed
- 2026-10-02: patched: Fix commit 804abf42a addresses the vulnerability by adding ownership checks and restricting auto-login key generation

## References

- [https://github.com/groundhoggwp/groundhogg/commit/804abf42a](https://github.com/groundhoggwp/groundhogg/commit/804abf42a)
- [https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/admin/contacts/contacts-page.php](https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9/admin/contacts/contacts-page.php)

## Related threats

- [Groundhogg arbitrary file deletion via copy_file](https://junglewise.ai/threats/cve-2026-109221-the-groundhogg-crm-newsletters-and-marketing-automation-plugin)
- [Groundhogg privilege escalation via contact identity rebinding](https://junglewise.ai/threats/cve-2026-97644-the-groundhogg-crm-newsletters-and-marketing-automation-plugin)
- [Groundhogg CRM unauthenticated stored cross-site scripting in web form fields](https://junglewise.ai/threats/cve-2026-81660-groundhogg-crm-unauthenticated-stored-cross-site-scripting-in-web)