Groundhogg CRM CVE-2026-97644

Requires an authenticated account at the Groundhogg Sales Representative role or higher - specifically one holding both the add_contacts capability (to reach POST /gh/v3/contacts) and the send_emails capability (to reach POST /gh/v4/emails/test). Exploitation is only possible on sites running Groundhogg 4.9 or earlier that have provisioned these non-administrator roles to the attacker; it is not pre-authentication. The core precondition is that the v3 create_contact path forwards the security-bearing user_id column into the Contacts_DB::add() upsert, which lacks the ownership guard enforced by Contacts_DB::update(). Limiting factors: the attacker must obtain a valid Sales-Rep-level login, and sites that do not delegate these roles to untrusted parties are not realistically exposed.

This is a genuine high-priority issue rather than a CVSS-inflated one, but with an important caveat on preconditions. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full confidentiality/integrity/availability loss - consistent with the described full WordPress Administrator takeover via a clean two-request chain. CWE-269 (improper privilege management) is the correct weakness class. The key limiting signal is PR:L: the attacker must already hold a Sales Representative (or higher) account, so this is privilege escalation from an authenticated foothold, not a pre-auth internet-wide bug, which meaningfully narrows the exposed population. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input, so exploitation likelihood cannot be quantified from these sources - absence of KEV/POC data is missing telemetry, not evidence of low risk. Net: treat as a priority patch for any site that grants non-admin Groundhogg roles to untrusted users, while recognizing that sites restricting Sales Representative access to trusted staff face lower realistic risk.

An attacker holding a Sales Representative account (e.g., an outsourced marketing contractor or a compromised low-tier staff login) sends a crafted POST to the v3 contacts REST endpoint containing a user_id field pointing at an Administrator account, rebinding a contact record to that admin. They then call the v4 email-test endpoint to mint an {auto_login_url} one-time key bound to the rebound contact and browse to it, which invokes wp_set_auth_cookie() and grants a fully authenticated Administrator session. No public exploit was identified in the provided data, but the chain is fully documented and uses only two REST calls.