Groundhogg is a WordPress plugin that allows privileged administrators to assume a support role. The vulnerability in the create_support_user() function causes any user whose login is groundhogg and whose email matches the hard‑coded support addresses to be silently promoted to administrator when the support‑access feature is triggered. This grants the attacker full control over the site, including the ability to become super‑admin on multisite installations if the triggering administrator has manage_network_options. The flaw stems from an inadequate check that uses only constant values and allows an attacker to control the email field, represented by CWE‑269.

The issue affects the Groundhogg plugin for WordPress produced by trainingbusinesspros. Versions up to and including 4.8.3 are vulnerable; later releases contain the fix.

The CVSS score of 8.1 indicates a high‑severity vulnerability. The exploit requires an attacker to first register or otherwise create an account with the login groundhogg and one of the two support emails, then wait for a legitimate administrator to invoke the support‑access workflow. Once the promotion occurs, the attacker can take over the site. No public exploit is known and the vulnerability is not listed in CISA’s KEV catalog, but the high score and the clear escalation path make it a significant risk. The EPSS score is not available, but the nature of the flaw suggests it could be actively leveraged if an attacker gains the prerequisite account.