Groundhogg WordPress Plugin CVE-2026-92975

Exploitation requires a precise two-actor sequence. First, an account must exist whose user_login is exactly 'groundhogg' AND whose user_email is one of the hardcoded constants 'support@groundhogg.io' or 'help@groundhogg.io' - achievable when open user registration is enabled or any other self-service account-creation path lets the attacker control their own login and email. Second, a legitimate administrator must actively invoke the plugin's support-access feature through the submit_ticket or process_send_support_access entry points, which triggers create_support_user() and silently promotes the matching account to administrator. Limiting factors: the attacker cannot complete the attack alone (depends on an admin action), open registration is not the default on many production sites, and the login/email values are fixed and public. Escalation to super admin on multisite additionally requires that the triggering administrator holds the manage_network_options capability.

This is a full-takeover privilege-escalation flaw (CWE-269) with high technical impact (C:H/I:H/A:H), but multiple real-world signals temper its urgency. The CVSS 3.1 base score of 8.1 is driven by the catastrophic impact rather than ease of exploitation: the vector correctly carries AC:H, reflecting that the attack is not self-contained. CONFLICT TO VERIFY: the official vector marks UI:N, yet the description explicitly states that 'a legitimate administrator must invoke the support-access feature' to trigger the promotion - this is effectively required interaction by a privileged victim, so UI:R and arguably PR:L (the attacker must control a pre-registered account) are more defensible; the published PR:N/UI:N likely overstates attacker autonomy. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or automated exploitation. The combination of high complexity, a mandatory two-actor sequence, dependence on open user registration (or another account-creation path), and specific hardcoded credentials means this is far more consistent with a targeted/opportunistic threat than mass exploitation. Treat as a priority patch for sites running Groundhogg with open registration or shared account-creation paths, but it is not a high-CVSS, drop-everything internet-wide worm candidate.

An attacker self-registers (on a site with open user registration) an account using login 'groundhogg' and email 'support@groundhogg.io' or 'help@groundhogg.io'. Later, an unsuspecting administrator opens a support ticket via the plugin's support-access feature (submit_ticket / process_send_support_access), and the vulnerable create_support_user() function matches the attacker's account against the hardcoded support constants and silently promotes it to administrator - or super admin on multisite. No public exploit was identified at time of analysis, and the attack's high complexity stems from needing both the pre-planted account and the administrator's action.