What is the CVSS score of CVE-2026-104385?

CVE-2026-104385 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Groundhogg are affected by CVE-2026-104385?

The Groundhogg marketing automation plugin for WordPress, in versions 4.8.3 and earlier, exposes confidential site data to remote retrieval by anyone who can reach the affected website, and no vendor…

How to fix or mitigate CVE-2026-104385?

Within 24 hours, inventory every WordPress installation using Groundhogg and confirm whether versions 4.8.3 or earlier are present; where Groundhogg is not business-critical, deactivate and remove the plugin immediately, and where it must remain operational, place the affected sites behind a web application firewall or reverse proxy with rules blocking unauthorized access to the plugin's endpoints and increase logging and monitoring on those paths. Within 7 days, engage the vendor for a timeline on a fixed release and, if the plugin must stay live, isolate the affected sites from sensitive data stores, rotate any credentials, API keys, or tokens that the plugin has access to, and confirm that no confidential data has been retrieved by reviewing access logs for anomalous requests. Within 30 days, upgrade to a patched Groundhogg release as soon as the vendor publishes one, and if none is available, replace Groundhogg with a maintained alternative or formally accept the risk with documented compensating controls, while verifying that all remaining installations are either updated or decommissioned.

Groundhogg CVE-2026-104385

EUVD-2026-93072 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-10-06 Patchstack

GHSA-rcq6-wxg2-hj48

WordPress Information Disclosure Groundhogg Wordpress Plugin

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote data-exposure flaw (PR:N/AV:N/AC:L) with confidentiality-only impact per CWE-201, so C:H and I:N/A:N; scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Oct 06, 2026 - 10:07 vuln.today

CVE Published

Oct 06, 2026 - 08:35 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the Groundhogg WordPress plugin versions 4.8.3 and earlier allows remote attackers to retrieve confidential information from affected sites. Tracked as CVE-2026-104385 with a CVSS score of 7.5, the flaw requires no authentication or user interaction and can be exploited over the network with low complexity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The input description does not name any specific feature, protocol, parameter, or non-default configuration mode, and the CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating remote unauthenticated exploitation against default installations of the Groundhogg WordPress plugin at versions ≤4.8.3. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw whose sole impact is a high loss of confidentiality (CWE-201, information exposure through sent data) with no integrity or availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every WordPress installation using Groundhogg and confirm whether versions 4.8.3 or earlier are present; where Groundhogg is not business-critical, deactivate and remove the plugin immediately, and where it must remain operational, place the affected sites behind a web application firewall or reverse proxy with rules blocking unauthorized access to the plugin's endpoints and increase logging and monitoring on those paths. …

Threat intelligence, references, and detailed analysis are available after sign-in.