Action required!
🛡️ Security patch for Groundhogg versions before 4.9
🤖 Fake groundhogg users being created on sites
Hi there,
Since October 30, bots have been registering a fake user on WordPress sites that run Groundhogg. The account uses the username groundhogg and the email support@groundhogg.io to make it look like it belongs to our support team.
Groundhogg only creates a support user on your site when you open a support ticket and choose to give our team access. If you didn't do that, the account isn't ours.
The bots are targeting a vulnerability (CVE-2026-92975) that was patched in Groundhogg 4.9. On an older version, if one of these fake accounts exists and an administrator later gives our team support access, the fake account can be promoted to administrator.
Please do the following today:
- Update Groundhogg to version 4.9 or later (we recommend the latest which is 4.10).
- Go to Users in your WordPress admin and search for groundhogg. Delete any user with that username, or with the email support@groundhogg.io or help@groundhogg.io. Do this even if you created it for a support ticket. If our team still needs access, you can give it again after updating and we'll get a fresh account.
- Don't give our team support access until you've done steps 1 and 2.
- If your site doesn't need public sign-ups, turn off Settings → General → Anyone can register.
If you think your site may have been affected, or you're not sure, reply to this email and we'll help you check.
We're sorry for the trouble and thank you for acting quickly.
~The Groundhogg Team | 