EUVD-2026-39615
GHSA-rxvc-vf4p-vf7c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable AJAX endpoint, any authenticated user exploitable due to commented-out capability check; impact is read-only data exfiltration, so I:N and A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Sales Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler wp_ajax_groundhogg_get_contacts_table has its capability check commented out and performs no nonce verification, meaning any authenticated user regardless of role can reach the vulnerable code path.
AnalysisAI
SQL Injection in the Groundhogg WordPress plugin (versions up to and including 4.5.4) allows any authenticated WordPress user - regardless of role - to extract sensitive data from the underlying database via the unsanitized 'after' parameter in the contacts table AJAX handler. The critical amplifier here is that the AJAX handler wp_ajax_groundhogg_get_contacts_table has its role capability check commented out and lacks nonce verification, effectively reducing the privilege bar from Sales Manager (as the CVE description initially implies) to any authenticated user including subscribers on open-registration sites. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation bar and the data exfiltration potential against CRM databases containing customer PII make this a meaningful risk for affected deployments.
Technical ContextAI
Groundhogg is a WordPress CRM, email marketing, and automation plugin developed by trainingbusinesspros. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically in the legacy-contact-query.php file where the 'after' parameter is appended to SQL queries without adequate escaping or parameterized preparation. Source references pinpoint the vulnerable lines at legacy-contact-query.php#L1013 and #L1017, contact-query.php#L2586, and contacts-page.php#L766. The AJAX action wp_ajax_groundhogg_get_contacts_table, registered through WordPress's AJAX API, is meant to be restricted by a capability check - however, that check is commented out in the 4.5.4 source (contacts-table.php#L101), and the handler performs no nonce verification. In WordPress's AJAX architecture, the wp_ajax_ hook requires only that a user be logged in, so the effective privilege requirement collapses to any valid WordPress session. The CPE cpe:2.3:a:trainingbusinesspros:groundhogg_-_crm,_newsletters,_and_marketing_automation:*:*:*:*:*:*:*:* covers all versions through 4.5.4.
RemediationAI
The primary fix is to update the Groundhogg plugin to a version beyond 4.5.4; a patch was committed to the WordPress plugin SVN repository as changeset 3585561 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3585561%40groundhogg&new=3585561%40groundhogg&sfp_email=&sfph_mail=), however the exact released version number containing this fix is not independently confirmed from the available input data - administrators should check the WordPress.org plugin page for the latest release and verify it is newer than 4.5.4. As an immediate compensating control if patching is not immediately possible, restrict WordPress user registration to prevent untrusted parties from obtaining any authenticated session, and audit which roles have access to the WordPress admin dashboard. Web application firewall rules targeting SQL metacharacter injection patterns in the 'after' POST parameter on wp-admin/admin-ajax.php requests can provide additional depth, though these may produce false positives on legitimate contact queries. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f2ba40d9-2d37-453a-a731-078f1de1fc69 should be monitored for confirmation of the fixed version.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today