CVE-2026-104385

Executive Summary

CVE-2026-104385 is an unauthenticated sensitive data exposure vulnerability in the Groundhogg WordPress plugin, affecting all versions up to and including 4.8.3. The flaw resides in the plugin's handling of sensitive information, allowing remote, unauthenticated attackers to retrieve data that should otherwise be protected. With a CVSS score of 7.5 (High) and no available patch, any internet-exposed WordPress site running the affected plugin is at immediate risk of data disclosure.

Technical Analysis

Groundhogg is a WordPress marketing automation and CRM plugin that handles contact records, form submissions, email campaign data, and other customer information. CVE-2026-104385 is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), indicating that the plugin includes sensitive information in outbound responses — for example, in HTTP responses, API outputs, or page content — instead of keeping it confined to protected server-side storage.

The vulnerability is reachable without authentication (PR:N) over the network (AV:N), requires no user interaction (UI:N), and no special conditions (AC:L). Because the issue involves information disclosure only, the Confidentiality impact is High (C:H), while Integrity and Availability impacts are None (I:N/A:N). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields a base score of 7.5.

Based on the CWE classification, the mechanism is an information leak: the application produces responses containing data that should not be exposed. This is not a code-execution or injection flaw. No public proof-of-concept, exploit code, or Nuclei template exists at the time of writing, and the specific endpoint, parameter, or response field that leaks data has not been publicly documented. Consequently, no function names, endpoints, or parameter names can be confirmed and none are asserted here. The attack surface is any WordPress installation with Groundhogg <= 4.8.3 accessible over HTTP/HTTPS.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the CWE-201 vulnerability class.

1. Reconnaissance / Target Identification: An attacker enumerates internet-facing WordPress sites and identifies those running the Groundhogg plugin at version 4.8.3 or earlier. This can be performed via passive tooling such as Shodan or by requesting publicly served plugin assets to fingerprint the installation.

2. Triggering the Flaw: Because the vulnerability is unauthenticated, the attacker sends a crafted HTTP request directly to an exposed plugin endpoint or page — no valid session, account, or credentials are required. The exact request format is not publicly documented; the attacker would probe for responses that contain sensitive information.

3. Payload / Execution: There is no code payload — the request itself is the exploit. The vulnerable response returns sensitive information (per CWE-201, sensitive data embedded in sent output) to the unauthenticated requester. Exploitation is essentially a read operation against an endpoint that should have restricted its output.

4. Post-Exploitation Impact: The attacker obtains sensitive data exposed by the plugin. Given Groundhogg's role as a CRM/marketing automation tool, this could include contact records, form-submission data, or other customer information. Disclosed data may enable further targeting, phishing, credential harvesting, or regulatory exposure. No lateral movement or code execution is implied by this advisory.

Impact Assessment

The business impact is a confidentiality breach affecting any organization hosting a WordPress site with Groundhogg <= 4.8.3. CVSS subscores: Confidentiality High, Integrity None, Availability None — meaning the primary harm is unauthorized access to sensitive information rather than service disruption or data tampering. Because exploitation is unauthenticated and requires no user interaction, the attack is trivially automatable and can be launched at scale against many sites simultaneously. Blast radius is bounded by what data the plugin exposes, which for a marketing automation/CRM plugin may include customer contact details and related submission data. There is no CISA KEV listing, no known exploit code, and no confirmed in-the-wild campaign at this time; EPSS has not yet been scored by FIRST.org. The absence of a patch (0/4 patch confidence) elevates residual risk for as long as affected installations remain exposed.

Detection Guidance

Sigma Rule

title: Groundhogg Unauthenticated Sensitive Data Exposure (CVE-2026-104385)
id: 8f2a1c7e-3b4d-4e9a-9c1f-groundhogg104385
status: experimental
description: Detects unauthenticated requests to Groundhogg plugin endpoints that may indicate exploitation of CVE-2026-104385.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104385
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/wp-content/plugins/groundhogg/'
      - '/wp-json/groundhogg/'
  selection_ua:
    cs(User-Agent)|contains:
      - 'python'
      - 'curl'
      - 'sqlmap'
  condition: selection_path and not selection_ua
fields:
  - c-ip
  - cs-uri-stem
  - cs(User-Agent)
falsepositives:
  - Legitimate site administrators and plugin API integrations
level: high

YARA Rule

rule CVE_2026_104385_Groundhogg_Data_Exposure
{
    meta:
        description = "Detects Groundhogg plugin artifacts associated with CVE-2026-104385"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104385"
        date = "2026-01-01"
    strings:
        $plugin_slug = "groundhogg" ascii nocase
        $sensitive_fields = /(email|phone|address|full_name|contact)[\"']?\s*[:=]/ nocase ascii
    condition:
        $plugin_slug and #sensitive_fields > 5
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104385 Groundhogg unauthenticated sensitive data exposure attempt"; flow:established,to_server; http.uri; content:"/wp-content/plugins/groundhogg/"; nocase; http.method; content:"GET"; sid:1043851; rev:1; reference:cve,2026-104385; classtype:attempted-recon;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "GET" and url.path like "*"/wp-content/plugins/groundhogg/*""]
  [http where http.response.status_code == 200 and http.response.bytes > 1000]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*/wp-content/plugins/groundhogg/*" OR uri_path="*/wp-json/groundhogg/*"
| eval suspicious=if(match(useragent, "(?i)(python|curl|wget|scanner)"), 1, 0)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, useragent, status
| where count > 5
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,groundhogg,wordpress">
  <rule id="104385" level="12">
    <if_sid>31100</if_sid>
    <url>/wp-content/plugins/groundhogg/</url>
    <description>CVE-2026-104385: Possible unauthenticated sensitive data exposure via Groundhogg plugin</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_104385,web_scan,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict or block external access to Groundhogg plugin endpoints using a WAF or web server rules, at least until a fixed release is available.
   • If Groundhogg is not operationally required, temporarily deactivate and remove plugin files.
   • Place the WordPress site behind authentication or IP allowlisting where feasible; avoid exposing marketing/CRM functionality to anonymous internet traffic.
   • Monitor web logs for unauthenticated requests to Groundhogg paths, as described in the detection section.

2. Patch/upgrade steps:

   • No patched version is currently available for CVE-2026-104385 (affected: <= 4.8.3). Monitor the vendor's official release channel and the WordPress plugin repository for a version greater than 4.8.3, and upgrade immediately once published.
   • Because no patch exists, do not assume upgrading to any specific version resolves the issue until an official advisory confirms it.

3. Long-term hardening:

   • Maintain an inventory of WordPress plugins and their versions; remove unused plugins to reduce attack surface.
   • Apply the principle of least privilege and minimize anonymous-accessible functionality in CRM/marketing plugins.
   • Integrate plugin vulnerability feeds into patch management and monitor NVD/WordPress advisories for Groundhogg updates.
   • Enforce WAF virtual patching and routine sensitive-data exposure testing for customer-facing endpoints.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104385
• CWE-201 — Insertion of Sensitive Information Into Sent Data: https://cwe.mitre.org/data/definitions/201.html
• Groundhogg plugin (WordPress.org repository): https://wordpress.org/plugins/groundhogg/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities catalog (no listing for CVE-2026-104385 at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-104385 at this time. No public PoC, exploit code, or Nuclei template is available.