WordPress Groundhogg Plugin Privilege Escalation via Support Account

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by matching against publicly hardcoded constants — `user_login` `'groundhogg'` and email addresses `'support@groundhogg.io'` / `'help@groundhogg.io'` — where the `in_array()` email-equality check at line 238 is not a security boundary because any user fully controls their own email value. This makes it possible for an attacker with an account whose `user_login` is `'groundhogg'` and whose `user_email` matches one of the hardcoded support constants to have that account silently promoted to administrator — and additionally to super admin on multisite when the triggering administrator holds `manage_network_options` — resulting in full site takeover. Exploitation requires a two-actor flow: the attacker must first obtain or

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Groundhogg CRM plugin for WordPress contains a critical privilege escalation vulnerability in its `create_support_user()` function that affects all versions through 4.8.3. The flaw stems from hardcoded user identification logic that relies on matching against static constants for username 'groundhogg' and support email addresses, combined with an insecure `in_array()` comparison that lacks proper type checking. An unauthenticated attacker can exploit this to create or hijack a support account with elevated privileges, potentially gaining administrative access to WordPress installations. This vulnerability impacts any organization using Groundhogg for CRM, email marketing, or automation workflows—commonly deployed in small to mid-sized businesses, nonprofits, and agencies managing customer relationships at scale.

Casky's 224 mapped skills detect this attack pattern through Claude AI's analysis of Privilege Escalation techniques (TA0004) by identifying suspicious account creation activities and permission model violations. Practitioners using Casky would observe findings that correlate hardcoded credential patterns, insecure type comparisons in authentication logic, and unexpected administrative account provisioning. The extended reasoning capability surfaces the root cause—the lack of cryptographic validation and reliance on publicly documented constants—allowing security teams to recognize similar anti-patterns in custom plugins or integrations. Detection would flag the absence of nonce verification, missing capability checks, and the dangerous assumption that hardcoded identifiers remain secret, enabling teams to remediate not just this CVE but similar privilege escalation risks in their WordPress ecosystem.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-92975.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-92975

Casky has 224 skills that investigate the attack patterns behind CVE-2026-92975. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn