CVE-2026-104725: CWE-269 Improper Privilege Management in trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation

CVE-2026-104725 is a privilege escalation vulnerability in the Groundhogg WordPress plugin (versions up to 4.9). The vulnerability is due to a missing ownership and capability check on the user parameter in the process_edit() function. Authenticated users with the edit_contacts capability can reassign contact records to any WordPress user ID without requiring edit_users or promote_users capabilities. This allows attackers with sales_rep-level access to escalate privileges to administrator by linking a contact to an administrator's user ID, creating a note with an {auto_login_link} tag to generate a valid auto-login URL, and then using that URL to authenticate as the targeted administrator. The auto-login URL is accessible to attackers because the sales_rep role has view_notes and add_notes capabilities by default.

An attacker with authenticated access and the edit_contacts capability can escalate privileges to administrator. This results in full control over the WordPress site, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 8.8 (high severity). The attacker can impersonate administrators by generating and using auto-login URLs tied to administrator accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the edit_contacts capability to trusted users only and monitor for suspicious note creation or contact reassignment activities. Avoid granting sales_rep or similar roles unnecessary capabilities that could be abused. Follow vendor advisories for updates and apply patches promptly once released.