CVE-2026-81741 — Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter

CVE-2026-81741

Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter PUBLISHED

Description (CNA)

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.

Affected (CNA)

Vendor / product	Versions
Unknown / Groundhogg — CRM, Newsletters, and Marketing Automation	affected 0 before 4.7.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/4bfdee51-f2d0-4549-a9b4-5f4e11f2de4c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.