Groundhogg, a WordPress plugin that manages contacts, allows an authenticated user carrying the edit_contacts capability to change the WordPress user ID linked to a contact record. By assigning a contact to an administrator account, the attacker can then create a note that contains the {auto_login_link} replacement tag. The resulting auto‑login URL, which the plugin stores in the note content, can be read back through the view_notes and add_notes capabilities that are granted to the sales_rep role. Visiting that URL authenticates the attacker as the administrator associated with the contact. Based on the description, the vulnerability originates in the process_edit() function, and the exploit is accomplished entirely through the WordPress admin interface by an authenticated user, making the attack vector a user‑authenticated web attack.

All installations of Groundhogg up to and including version 4.9, deployed on WordPress sites. The flaw exists in the contact administration panels where the process_edit() function resides and has been documented in the plugin’s source code up to tag 4.9.

The CVSS score of 8.8 indicates high severity, and the lack of a KEV listing means no publicly documented exploitation is known as of this analysis. EPSS data are not available, so the likelihood of exploitation cannot be quantified; however, the required privileges—edit_contacts, view_notes, add_notes—are commonly granted to sales_rep or similar roles, so an attacker can realistically gain administrator access once the plugin is present on a target site. The likely attack vector is a web‑based authentication bypass within the WordPress admin UI, and the vulnerability would enable a local privilege escalation into full site administrator rights.