CVE-2026-97644 is a privilege escalation vulnerability in the Groundhogg WordPress plugin (versions up to 4.9). The vulnerability arises because the create_contact function in the v3 REST endpoint is protected only by the add_contacts capability but forwards the entire request payload, including the user_id field, to the Contacts_DB::add() method. This bypasses ownership checks enforced in update operations, allowing an attacker to rebind any contact to an arbitrary WordPress user ID. Subsequently, the attacker can use the v4 email-test endpoint, accessible with the send_emails capability, to generate an auto-login URL bound to the rebound contact. Using this URL, the attacker can call wp_set_auth_cookie() and obtain a fully authenticated session as the targeted WordPress Administrator.

An authenticated user with Sales Representative-level privileges can escalate their privileges to full administrator access by rebinding contact records and generating auto-login URLs. This compromises confidentiality, integrity, and availability of the WordPress site, allowing full control over the site and its data.

No official patch or fix is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Sales Representative-level access and monitor for suspicious use of the affected REST endpoints. Avoid granting the add_contacts and send_emails capabilities to untrusted users.