Groundhogg CVE-2026-81741

The Groundhogg plugin must be installed and active on a WordPress site (version < 4.7.2) with its email preference confirmation flow enabled - this is a standard default feature of the plugin, not a non-default configuration. No authentication is required from the attacker; however, the attack requires a victim to click the crafted link (UI:R), making purely automated, mass exploitation unlikely. The redirect occurs as a natural part of the confirmation workflow, so no server-side code execution or elevated privileges are needed. Exploitation is limited by the need for social engineering to deliver the crafted link convincingly.

The CVSS base score of 4.7 is appropriate for an open redirect: the attack requires user interaction (UI:R) - a victim must click a crafted link - which meaningfully caps exploitability. EPSS at 0.14% (3rd percentile) confirms very low observed exploitation probability, consistent with the social-engineering prerequisite. The vulnerability is not listed in CISA KEV. Despite these moderate signals, the presence of a public WPScan proof-of-concept lowers the technical barrier for abuse. The S:C scope change in the CVSS vector correctly captures that the primary harm occurs off-site (credential phishing, malware delivery). Because the crafted URL can be embedded in any email or message that appears to come from a trusted Groundhogg-powered site, the phishing surface is real for sites with active subscriber lists. Overall: low immediate automated exploitation risk but meaningful phishing risk for targeted campaigns against plugin users.

An attacker identifies a WordPress site running the vulnerable Groundhogg plugin and crafts a confirmation-flow URL that includes an external phishing domain as the redirect target. The attacker distributes this link via email or social media, styled as a legitimate 'manage your email preferences' link from the target site. When a recipient clicks it, their browser is silently redirected to the attacker's credential-harvesting page after the plugin processes the confirmation step. A public WPScan proof-of-concept confirms this attack path is straightforward to execute.