Seeing a “groundhogg” user on your site? Here’s what’s going on

Adrian, Founder here.

If you found a new user called groundhogg on your WordPress site, or got an email from us about one, this post explains what’s going on. The short version: it’s most likely nothing to worry about, but it’s worth two minutes of your time to clean up.

TL;DR

• Bots are signing up on WordPress sites with the username groundhogg and the email support@groundhogg.io. We didn’t create these accounts.
• On their own, these accounts can’t do anything. They’re regular users with no special access.
• Delete the user, update Groundhogg to 4.9 or later, and rest easy.

What’s happening?

On the evening of October 30, our support inbox started filling up with “Login Details” and “Set your password” emails from WordPress sites all over the world. Each one was a site letting us know a new account had been created with our support email address.

We didn’t sign up for any of them. A bot is visiting sites that run Groundhogg and using their public sign-up forms to register a user that looks like it belongs to our support team.

Why would a bot do that?

It’s trying to take advantage of a vulnerability in older versions of Groundhogg (CVE-2026-92975), reported to us by the Wordfence team and fixed in Groundhogg 4.9.

When you need help, Groundhogg lets you give our support team access to your site from inside the plugin, using the share access option when you submit a support ticket. Before 4.9, that feature recognized our support account just by its username and email address. So if a fake account with the same details already existed, sharing access could upgrade the fake account to an administrator instead of creating a real one for us.

In 4.9 we fixed it so that can’t happen.

Am I at risk?

Almost certainly not. For a fake account to become an administrator, all three of these have to be true:

1. Your site is running a version of Groundhogg older than 4.9.
2. A fake groundhogg user exists on your site.
3. Someone on your site used share access or submit a support ticket in the plugin after that fake user was created.

If you haven’t shared access with us or submitted a ticket from inside the plugin recently, your site has not been compromised.

It’s also worth knowing that when your site sent its “set your password” email, it came to us, not the bot. We haven’t used any of those links.

What should I do?

1. Update Groundhogg to version 4.9 or later. We recommend the latest version, 4.10.
2. Delete the user. Go to Users in your WordPress admin, search for groundhogg, and delete any user with that username or with the email support@groundhogg.io or help@groundhogg.io. If it’s a real support account left over from an old ticket, delete it anyway. If we need access again, you can share it again and we’ll get a fresh account.
3. Optional: if your site doesn’t need public sign-ups, turn off Settings → General → Anyone can register. That stops bots like this one from creating accounts in the first place.

That’s it.

What we’ve done

• Fixed the vulnerability in Groundhogg 4.9, working with Wordfence.
• Emailed Groundhogg users and customers with these same instructions.
• Personally contacted the owner of every site that sent a sign-up email to our support inbox, so they know to delete the account.

Questions?

If you’re not sure whether your site was affected, or you did share access with us recently, email us at help@groundhogg.io and we’ll help you check.

Thanks for keeping your sites up to date. Stay safe.