Broken Access Control in Groundhogg by WordPress
CVE-2026-40793

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Groundhogg
Vendor
CVE Published:
15 June 2026

What is CVE-2026-40793?

Groundhogg versions prior to 4.4.1 are susceptible to a broken access control vulnerability, allowing unauthorized users to access restricted functionality. This can lead to serious security implications, including unauthorized data manipulation and potential exposure of sensitive user information. It is essential for users to update their Groundhogg installations to the patched version to safeguard against these risks.

Affected Version(s)

Groundhogg < 4.4.1

References

https://patchstack.com/database/wordpress/plugin/groundho...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Herman | Patchstack Bug Bounty Program
.