CVE-2026-97644 Groundhogg CRM - Privilege Escalation

Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress <= 4.9 contains a privilege escalation caused by contact identity rebinding via the create_contact function in the v3 REST endpoint, letting authenticated attackers with Sales Representative-level access rebind contacts to arbitrary user IDs and gain administrator access, exploit requires attacker to have Sales Representative-level access.