Quick answers
- Is CVE-2026-97644 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-97644 being exploited in the wild.
- How severe is CVE-2026-97644?
- High severity, with a CVSS score of 8.8, published 3 October 2026.
- Which products and versions are affected?
- Groundhogg — CRM, Newsletters, and Marketing Automation up to and including 4.9.
- Is there a fix for CVE-2026-97644?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-97644 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-97644?
- Check whether you run Groundhogg — CRM, Newsletters or and Marketing Automation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the v3 REST endpoint POST /gh/v3/contacts, where the create_contact function forwards the user_id parameter directly to Contacts_DB::add() without ownership validation, while Contacts_DB::update() enforces such checks. An authenticated attacker with the add_contacts capability (Sales Representative role or above) can rebind existing contact records to an Administrator's user ID, then use the v4 email-test endpoint to generate an auto-login URL, and consume it to establish an authenticated Administrator session via wp_set_auth_cookie().
Affected products
- Groundhogg Groundhogg — CRM, Newsletters, and Marketing Automation up to and including 4.9
Timeline
- 2026-10-03: disclosed