Improper Redirect Vulnerability in Groundhogg WordPress Plugin
CVE-2026-81741
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-81741?
The Groundhogg WordPress plugin, before version 4.7.2, is susceptible to an improper redirect vulnerability. This flaw allows attackers to manipulate the email preference confirmation flow, leading to the potential redirection of unsuspecting users to arbitrary external URLs. By crafting malicious links, unauthorized individuals can exploit this vulnerability, exposing users to phishing attacks or distributing malware without any authentication barriers.
Affected Version(s)
Groundhogg — CRM, Newsletters, and Marketing Automation 0 < 4.7.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.