CVE-2026-92975: Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser() function. This is due to the function identifying the support account solely by matching against publicly hardcoded constants — userlogin 'groundhogg' and email addresses 'support@groundhogg.io' / 'help@groundhogg.io' — where the inarray() email-equality check at line 238 is not a security boundary because any user fully controls their own email value. This makes it possible for an attacker with an account whose userlogin is 'groundhogg' and whose useremail matches one of the hardcoded support constants to have that account silently promoted to administrator — and additionally to super admin on multisite when the triggering administrator holds managenetworkoptions — resulting in full site takeover. Exploitation requires a two-actor flow: the attacker must first obtain or pre-plant an account with the hardcoded credentials (possible when open user registration is enabled or another account-creation path exists), after which a legitimate administrator must invoke the support-access feature via the submitticket or processsendsupportaccess entry points to trigger the promotion.
Affected Software
Event History
Frequently Asked Questions
What conditions must be present for exploitation to succeed?
An attacker must obtain or pre-plant an account with the user_login value "groundhogg" and an email address of either "support@groundhogg.io" or "help@groundhogg.io". A legitimate administrator must then invoke the support-user creation flow.
Which sites are most exposed to account pre-planting?
Sites with open user registration enabled, or any other account-creation path that lets an attacker create the required account identity, can allow the prerequisite account to be created. The issue affects versions through 4.8.3.
How can administrators check for signs of exposure?
Review WordPress accounts for a username of "groundhogg" paired with either "support@groundhogg.io" or "help@groundhogg.io". Such an account can be silently promoted when the support-user flow is invoked.
What is the additional impact on WordPress multisite deployments?
On multisite, the promoted account can also become a super admin if the administrator triggering the flow has the manage_network_options capability. This can extend the takeover impact across the network.