What is the CVSS score of CVE-2026-40793?

CVE-2026-40793 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-40793?

Yes, a patch is available for CVE-2026-40793. Update the affected software to the latest version immediately.

Groundhogg CVE-2026-40793

Q: Which versions of Groundhogg are affected by CVE-2026-40793?

Broken access control in the Groundhogg WordPress CRM/marketing automation plugin (all versions below 4.4.1) allows low-privileged subscriber-level users to perform unauthorized privileged operations…. A patch is available.

EUVD-2026-36996 MEDIUM

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-9mp4-cjfh-xpp5

Authentication Bypass Groundhogg

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Subscriber-level account required (PR:L); network-accessible WordPress endpoint with no interaction needed; integrity-only impact with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:07 vuln.today

Patch available

Jun 15, 2026 - 22:02 EUVD

DescriptionCVE.org

Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.

AnalysisAI

Broken access control in the Groundhogg WordPress CRM/marketing automation plugin (all versions below 4.4.1) allows low-privileged subscriber-level users to perform unauthorized privileged operations due to missing authorization checks (CWE-862), resulting in high integrity impact. The vulnerability is network-exploitable with low complexity, requiring only a subscriber-level WordPress account - a role freely obtainable via self-registration on many WordPress sites. No public exploit has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog; a vendor-released patch (version 4.4.1) is confirmed available.

Technical ContextAI

Groundhogg is a WordPress-native CRM and email marketing automation plugin. CWE-862 (Missing Authorization) identifies that specific plugin endpoints or AJAX handlers execute privileged operations without first verifying whether the requesting user holds sufficient WordPress role permissions. In WordPress's role hierarchy, 'subscriber' is the lowest authenticated role, below contributor, author, editor, and administrator. When authorization checks are absent or insufficient, subscriber-level sessions can trigger functionality intended for higher roles such as managing contacts, campaigns, or plugin settings. The affected scope is the entire Groundhogg plugin codebase prior to 4.4.1, as captured by CPE cpe:2.3:a:groundhogg:groundhogg:*:*:*:*:*:*:*:*. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the flaw is reachable remotely via standard HTTP with no scope change, isolating the integrity impact to the vulnerable WordPress installation itself.

RemediationAI

The primary remediation is to update the Groundhogg plugin to version 4.4.1 or later, which contains the vendor-released authorization fix confirmed by Patchstack. Site administrators should apply this update immediately via the WordPress plugin dashboard or by downloading directly from the plugin repository. As a compensating control on unpatched installations, disabling open user registration (WordPress Admin > Settings > General > uncheck 'Anyone can register') prevents unauthenticated internet users from obtaining the subscriber account needed to exploit this flaw - note this trade-off blocks legitimate new user sign-ups. Additionally, a WAF rule blocking unauthenticated or subscriber-session requests to Groundhogg-specific REST API or admin-ajax endpoints can reduce exposure, though this risks disrupting normal subscriber-facing plugin functionality and requires careful tuning. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-4-1-broken-access-control-vulnerability provides further remediation guidance.