{"id":"CVE-2026-104385","published":"2026-10-06T09:17:37.917","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-201"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-8-3-sensitive-data-exposure-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A sensitive data exposure vulnerability in Groundhogg allows unauthenticated attackers to access private user data without requiring any credentials or authentication. This represents a significant privacy and security risk as it exposes potentially sensitive information to anyone who can reach the affected system.","exploitability":"The vulnerability is highly exploitable with no prerequisites as attackers can directly access sensitive data endpoints without authentication, making it easy to leverage for data exfiltration.","blast_radius":"The impact could be substantial across all Groundhogg installations running versions 4.8.3 or earlier, potentially exposing personal user information, contact details, and other private data to unauthorized parties.","remediation":"Upgrade to version 4.8.4 or later to remediate this sensitive data exposure vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["data-exposure","sensitive-data","unauthenticated","web"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:04:21.941Z"}}