Skip to main content

HollerBox CVE-2026-106603

| EUVDEUVD-2026-94930 MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-10-08 Patchstack GHSA-q6c9-q8g8-hh32
WordPress Authentication Bypass Groundhogg Wordpress Plugin Hollerbox
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
vuln.today AI
6.5 MEDIUM

Network-reachable IDOR with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact limited to modifying/disrupting plugin objects, so I:L/A:L and C:N with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Oct 08, 2026 - 15:11 vuln.today
CVE Published
Oct 08, 2026 - 12:27 cve.org
MEDIUM 6.5

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14.

AnalysisAI

Authorization bypass in the WordPress plugin HollerBox (Groundhogg) through version 2.3.14 allows unauthenticated remote attackers to manipulate plugin-managed objects by supplying a user-controlled key that the plugin fails to validate against ownership or access level. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) confirms no authentication or user interaction is required and impact is limited to integrity and availability, with no data disclosure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the HollerBox plugin (version through 2.3.14) be installed and active on the target WordPress site, and that a request reach the vulnerable endpoint which resolves objects by a user-supplied key/identifier without an ownership or access-level check. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a moderate-severity authorization bypass (IDOR, CWE-639) in the HollerBox WordPress plugin, scored CVSS 6.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch is identified in the available data, so verification of an updated HollerBox release should begin with the vendor's plugin page and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/holler-box/vulnerability/wordpress-hollerbox-plugin-2-3-14-insecure-direct-object-references-idor-vulnerability, which is the authoritative source for a fixed version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Groundhogg

View all
CVE-2019-15647 HIGH POC
8.8 Aug 27

The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code exe
CVE-2023-1425 HIGH POC
7.2 Apr 10

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner - Groundhogg WordPress plugin before 2.7.9.
CVE-2023-2111 MEDIUM POC
4.9 May 30

The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL quer
CVE-2026-57389 HIGH
8.6 Jul 13

Path traversal in the Groundhogg WordPress CRM/marketing-automation plugin (versions up to and including 4.4.1) lets rem
CVE-2026-40727 HIGH
7.7 Jun 15

Arbitrary file deletion in the Groundhogg WordPress plugin (versions 4.4 and earlier) allows authenticated users with th
CVE-2026-104408 HIGH
7.6 Oct 05

Blind SQL injection in the Groundhogg WordPress plugin (versions through 4.8.3) allows an authenticated high-privilege u
CVE-2023-34179 HIGH
7.6 Nov 03

A vulnerability in Adrian Tobey Groundhogg groundhogg.7.11. Rated high severity (CVSS 7.6), this vulnerability is remote
CVE-2026-104385 HIGH
7.5 Oct 06

Unauthenticated sensitive data exposure in the Groundhogg WordPress plugin versions 4.8.3 and earlier allows remote atta
CVE-2023-2736 HIGH
7.5 May 20

The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.
CVE-2026-48885 HIGH
7.1 Jun 15

Unauthenticated reflected/stored cross-site scripting in the HollerBox WordPress plugin (versions 2.3.10.1 and earlier)

CVE-2026-85310 MEDIUM
6.5 Sep 10

Path traversal in the import_contacts function of the Groundhogg WordPress CRM plugin (versions ≤ 4.7.1) allows authenti
CVE-2026-40793 MEDIUM
6.5 Jun 15

Broken access control in the Groundhogg WordPress CRM/marketing automation plugin (all versions below 4.4.1) allows low-

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Share

CVE-2026-106603 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy