Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.7
CVE-2026-81741: Groundhogg can redirect users to external sites
CVE-2026-81741 · published 1 month ago
Summary
The Groundhogg WordPress plugin versions before 4.7.2 let a special link send visitors to any web address you choose. This means an attacker could trick users into visiting malicious sites, potentially leading to phishing or malware. Upgrade the plugin to version 4.7.2 or later, or stop using the email preference link until it is fixed.
What to do
- Update unknown groundhogg — crm, newsletters, and marketing automation to version 4.7.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | groundhogg — crm, newsletters, and marketing automation | < 4.7.2 |
Original advisory text
Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.7
Medium
Type
CWE-601Open Redirect
Timeline
Published9 Sep 2026
Updated3 Nov 2026
First seen9 Sep 2026
Track software like this
Free during beta