CVE-2026-92975: CWE-269 Improper Privilege Management in trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation

CVE-2026-92975 is a privilege escalation vulnerability in the Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin up to version 4.8.3. The vulnerability arises because the create_support_user() function identifies support accounts by matching user_login and user_email against hardcoded constants ('groundhogg' and '[email protected]' / '[email protected]'). Since users control their email addresses, an attacker can create or obtain an account with these credentials. When a legitimate administrator invokes the support-access feature (via submit_ticket or process_send_support_access), the attacker’s account is silently promoted to administrator or super admin (if multisite and the admin has manage_network_options), enabling full site takeover.

Successful exploitation allows an attacker to escalate privileges from a low-level user to administrator or super admin, resulting in full control over the WordPress site or multisite network. This includes the ability to modify site content, install malicious plugins, and compromise all site data and users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid invoking the support-access feature if untrusted accounts with the user_login 'groundhogg' and matching support emails exist. Consider disabling open user registration or restricting account creation paths to prevent attacker account creation with these credentials.