EUVD-2026-39928
GHSA-cc9f-rh6g-8362
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable via HTTP, low complexity, marketer-level auth required (PR:L), read-only confidentiality impact with no integrity or availability effect confirmed.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'search' parameter in all versions up to, and including, 4.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with marketer-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the Groundhogg CRM, Newsletters, and Marketing Automation WordPress plugin exposes the underlying WordPress database to authenticated attackers holding marketer-level access or higher. The 'search' parameter is insufficiently escaped across at least five distinct code paths - spanning db/db.php, db/steps.php, and api/v4/base-object-api.php - allowing appended SQL payloads to exfiltrate sensitive data including contact records, campaign data, and potentially WordPress user credentials. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the vulnerability is straightforward to exploit with valid credentials given the low complexity rating.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) describes this root cause: user-supplied input to the 'search' parameter reaches database query construction without adequate escaping or parameterized preparation. The CPE string (cpe:2.3:a:trainingbusinesspros:groundhogg_-_crm,_newsletters,_and_marketing_automation:*:*:*:*:*:*:*:*) confirms the vulnerable component as the trainingbusinesspros vendor's Groundhogg plugin running on WordPress. Wordfence's references identify at least five vulnerable code locations: db/db.php at lines 330 and 395, db/steps.php at lines 231 and 254, and api/v4/base-object-api.php at line 488, indicating the SQL injection surface is not isolated to a single function but is systemic across database interaction and REST API layers. The 'marketer' role is a Groundhogg-specific capability tier below WordPress administrator but above subscriber, meaning this flaw is exploitable by plugin-specific privileged users, not just site admins.
RemediationAI
Update the Groundhogg plugin to the first release following version 4.5.5, as the upstream fix is confirmed via WordPress plugin Trac changeset 3586389 (https://plugins.trac.wordpress.org/changeset?reponame=&new=3586389%40groundhogg&old=3586389%40groundhogg); however, the exact patched release version number is not independently confirmed from available data and should be verified at the WordPress plugin repository before deploying. As a compensating control pending upgrade, restrict assignment of the Groundhogg 'marketer' role to only fully trusted and necessary users, since this role is the minimum privilege level required for exploitation. Reviewing current role assignments within the plugin's user management interface is advisable as an immediate action. Disabling API endpoints exposed by api/v4/base-object-api.php via WAF rules or network-level access controls (e.g., blocking REST API routes containing the 'search' parameter for non-admin roles) can reduce attack surface, though this may break legitimate marketer workflows. There are no generic workarounds that eliminate the underlying injection risk without patching.
Stored Cross-Site Scripting in the Groundhogg - CRM, Newsletters, and Marketing Automation WordPress plugin before versi
SQL Injection in the Groundhogg CRM, Newsletters, and Marketing Automation WordPress plugin (all versions through 4.5.8)
Insecure Direct Object Reference in the Groundhogg WordPress plugin (all versions through 4.5.2) allows authenticated us
SQL injection in the Groundhogg WordPress CRM plugin (versions through 4.5.14) permits authenticated attackers holding v
SQL Injection in the Groundhogg WordPress CRM plugin (all versions through 4.5.5) allows authenticated attackers holding
SQL Injection in the Groundhogg WordPress plugin (versions up to and including 4.5.4) allows any authenticated WordPress
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today