WordPress Groundhogg Plugin Privilege Escalation via Contact Reassignment

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the `user` parameter within the `process_edit()` function, which allows any authenticated user with the `edit_contacts` capability to reassign a contact record's linked WordPress user ID to any arbitrary account without requiring the `edit_users` or `promote_users` capabilities. This makes it possible for authenticated attackers, with sales_rep-level access and above, to escalate their privileges to administrator by linking a contact to an administrator's WordPress user ID, then creating a note containing the `{auto_login_link}` replacement tag to trigger generation of a valid auto-login permissions-key URL for the administrator-linked contact, and finally visiting that URL to authenticate as the targeted administrator. The auto-login URL is stored in the note content a

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Groundhogg CRM plugin for WordPress contains a critical privilege escalation vulnerability in versions up to 4.9 that allows authenticated users to hijack contact records by reassigning them to arbitrary WordPress accounts. Any user with the `edit_contacts` capability can exploit missing ownership and capability checks in the `process_edit()` function to reassign a contact's linked WordPress user ID without requiring `edit_users` or `promote_users` permissions. This is particularly dangerous because it enables lateral privilege escalation—a contact manager could reassign high-value contacts to themselves or to attacker-controlled accounts, or could escalate their own privileges by linking their contact record to an administrative account. Organizations running Groundhogg for customer relationship management, email marketing, or sales automation are directly affected, especially those with multiple user roles managing contacts.

Casky.ai's 224 mapped skills detect this vulnerability pattern by analyzing authentication and authorization anomalies associated with MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would identify suspicious findings including: unexpected changes to user-contact associations where low-privilege accounts modify the `user` parameter in edit requests, capability mismatches where `edit_contacts` permissions are used to perform `edit_users`-level actions, and audit logs showing contact ownership transfers to accounts that shouldn't have access to those records. Claude's extended reasoning correlates these behavioral indicators across multiple security events to surface the attack chain—identifying when an authenticated user systematically reassigns high-value contacts or modifies their own contact record's user linkage without proper authorization. This pattern-based detection catches both opportunistic abuse and coordinated privilege escalation attempts that traditional rule-based systems might miss.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-104725.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-104725

Casky has 224 skills that investigate the attack patterns behind CVE-2026-104725. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn