CVE-2026-104725

Executive Summary

CVE-2026-104725 is a privilege escalation vulnerability in the Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin affecting all versions up to and including 4.9. The flaw stems from a missing ownership and capability check on the user parameter within the process_edit() function, allowing any authenticated user with the edit_contacts capability (sales_rep-level and above) to reassign a contact's linked WordPress user ID to an arbitrary account. This enables attackers to escalate to administrator by abusing Groundhogg's {auto_login_link} replacement tag to generate a valid auto-login permissions-key URL for the targeted administrator, resulting in full site compromise.

Technical Analysis

The vulnerability resides in Groundhogg's contact-editing workflow, specifically within the process_edit() function. When an authenticated user with the edit_contacts capability submits a contact edit request, the function processes a user parameter that controls which WordPress user account is linked to the contact record. In vulnerable versions (<= 4.9), this parameter lacks both an ownership check (verifying the acting user is permitted to modify the specific contact) and a capability check for edit_users or promote_users.

Consequently, any user holding edit_contacts — a capability granted by default to the sales_rep role — can reassign a contact's linked WordPress user ID to the ID of any account, including an administrator. Because Groundhogg ties its note-generation and communication features to contact-linked users, the reassignment creates a trust relationship between the attacker-controlled contact and the administrative account.

The escalation is completed through the {auto_login_link} replacement tag. Groundhogg supports dynamic replacement tags inside note content. When a note containing {auto_login_link} is created, the plugin generates a valid auto-login permissions-key URL for the linked contact's associated WordPress user. Since the contact is now linked to an administrator, the generated URL authenticates as that administrator. The URL is stored in the note content and can be read back by the attacker via the view_notes and add_notes capabilities, which sales_rep holds by default. Visiting the URL completes authentication as the administrator.

The root cause maps to CWE-269 (Improper Privilege Management): the plugin fails to enforce authorization boundaries when dereferencing a user-controlled parameter into a privileged identity link.

Exploitation Scenarios

No public PoC is available. The attack chain below is derived strictly from the NVD description and reported vulnerability class.

1. Reconnaissance/target identification: The attacker identifies a WordPress site running Groundhogg <= 4.9 with an active administrative account. Basic plugin enumeration (e.g., via publicly rendered assets) confirms Groundhogg presence.

2. Trigger of the flaw class: The attacker authenticates with at least sales_rep-level access — an account holding edit_contacts. Using the contact-editing interface, the attacker invokes the process_edit() flow and supplies the user parameter set to the target administrator's WordPress user ID. The missing ownership and capability checks allow the reassignment without edit_users or promote_users.

3. Payload/execution: The attacker creates a note on the now administrator-linked contact containing the {auto_login_link} replacement tag. Groundhogg resolves the tag and generates a valid auto-login permissions-key URL bound to the administrator account. The attacker reads the note content back via the view_notes/add_notes capabilities to obtain the URL.

4. Post-exploitation impact: The attacker visits the auto-login URL and is authenticated as the administrator. From there, full site takeover is possible — installing backdoor plugins, exfiltrating data, creating rogue admin accounts, or modifying site content — consistent with the CVSS impact ratings of High Confidentiality, Integrity, and Availability.

Impact Assessment

Successful exploitation grants full administrative control of the WordPress site. The CVSS 3.1 score of 8.8 reflects network attack vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and High impact across Confidentiality, Integrity, and Availability (C:H/I:H/A:H) with unchanged scope (S:U). The blast radius includes all data and functionality managed by the WordPress installation and the Groundhogg CRM — contact records, customer PII, marketing lists, and any integrations reachable with administrative credentials. Multi-tenant or membership sites may expose numerous users. Since only a modest capability (edit_contacts) is required, the pool of potential internal attackers (employees, contractors, low-privilege accounts) is broad.

Detection Guidance

Sigma Rule

title: Groundhogg Privilege Escalation via process_edit user Parameter
id: 3f9a1c72-8b4e-4d21-9c05-1a7e6f0b2d44
status: experimental
description: Detects requests manipulating the user parameter in Groundhogg process_edit() contact edits, consistent with CVE-2026-104725 privilege escalation.
logsource:
  product: webserver
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'POST'
    c-uri|contains: 'admin-ajax.php'
  selection_action:
    cs-body|contains: 'action='
  selection_groundhogg:
    cs-body|contains:
      - 'process_edit'
      - 'groundhogg'
  selection_param:
    cs-body|contains: 'user='
  condition: selection_endpoint and selection_action and selection_groundhogg and selection_param
fields:
  - c-ip
  - cs-uri
  - cs-body
falsepositives:
  - Legitimate administrative contact edits
level: medium

YARA Rule

rule CVE_2026_104725_Groundhogg_PrivEsc
{
    meta:
        description = "Detects Groundhogg plugin artifacts referencing process_edit and auto_login_link tied to CVE-2026-104725"
        author = "Threat Intelligence"
        reference = "CVE-2026-104725"
        date = "2026-01-01"
        severity = "high"

    strings:
        $fn = "process_edit" ascii wide nocase
        $tag = "{auto_login_link}" ascii wide nocase
        $cap1 = "edit_contacts" ascii wide nocase
        $cap2 = "promote_users" ascii wide nocase
        $plugin = "groundhogg" ascii wide nocase

    condition:
        uint16(0) == 0x3C3F or $plugin or ($fn and $tag)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104725 Groundhogg process_edit user Parameter Privilege Escalation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin-ajax.php"; http.request_body; content:"process_edit"; nocase; http.request_body; content:"user="; nocase; http.request_body; content:"groundhogg"; nocase; classtype:attempted-admin; sid:2026104725; rev:1;)

Elastic Detection

any where
  event.category == "web" and
  http.request.method == "POST" and
  stringContains(http.request.body, "action=") and
  stringContains(http.request.body, "process_edit") and
  stringContains(http.request.body, "user=")

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri_path="*/admin-ajax.php*" form_data="*process_edit*" form_data="*user=*"
| eval risk="CVE-2026-104725 Groundhogg priv-esc"
| table _time, src_ip, clientip, uri_path, form_data, risk
| sort -_time

Wazuh OSSEC Rule

<group name="web,groundhogg,wordpress,">
  <rule id="100725" level="12">
    <if_sid>31100</if_sid>
    <url>admin-ajax.php</url>
    <match>process_edit</match>
    <match>user=</match>
    <description>CVE-2026-104725: Possible Groundhogg process_edit privilege escalation attempt</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Audit and restrict the edit_contacts, view_notes, and add_notes capabilities — do not grant these to untrusted or low-privilege roles. Remove sales_rep-level access for accounts that do not require it.
• Disable or deactivate the Groundhogg plugin if it is not business-critical until a fix is available.
• Enforce administrative review of role assignments and monitor for note creation containing {auto_login_link}.
• Require MFA for all administrative accounts to blunt the post-escalation auto-login impact.

2. Patch/upgrade steps:

• No patch is currently available. Monitor the Groundhogg vendor channel for version 4.9+ fixes. Once released, upgrade immediately and verify the release notes address the process_edit() capability/ownership check on the user parameter.

3. Long-term hardening:

• Apply least-privilege role design across all WordPress roles and custom capabilities.
• Deploy server-side request logging and the detection rules above.
• Maintain a WordPress WAF with virtual patching for known plugin logic flaws where available.

References

• NVD — CVE-2026-104725: https://nvd.nist.gov/vuln/detail/CVE-2026-104725
• MITRE CWE-269 (Improper Privilege Management): https://cwe.mitre.org/data/definitions/269.html
• MITRE ATT&CK T1068 (Exploitation for Privilege Escalation): https://attack.mitre.org/techniques/T1068/
• Groundhogg plugin project page: https://wordpress.org/plugins/groundhogg/
• WordPress capability reference (edit_users, promote_users): https://wordpress.org/documentation/article/roles-and-capabilities/

No threat actor campaigns or exploit-in-the-wild evidence are currently associated with this CVE based on the provided data.