EUVD-2026-39930
GHSA-qmp7-mx7r-2rf4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable REST API, low-complexity FilterException bypass, authenticated Sales Rep role required (PR:L), read-only database exfiltration with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via 'query[select]' Parameter in all versions up to, and including, 4.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Sales Representative-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitized Contact_Query code path can be bypassed by supplying an invalid filter type (e.g., query[filters][0][0][type]=invalid_filter_nonexistent), causing a FilterException to be caught and execution to fall through to the unsanitized Legacy_Contact_Query path.
AnalysisAI
SQL Injection in the Groundhogg WordPress CRM plugin (all versions through 4.5.5) allows authenticated attackers holding Sales Representative-level access or above to extract arbitrary data from the underlying WordPress database via the query[select] REST API parameter. The vulnerability is exploitable through a deliberate sanitization bypass: submitting an invalid filter type in query[filters] triggers a FilterException that silently redirects execution from the protected Contact_Query path to the unprotected Legacy_Contact_Query path. No CISA KEV listing or confirmed public exploit code exists at time of analysis, though Wordfence's advisory directly references vulnerable source lines at plugin version 4.5.5, materially lowering the barrier to independent PoC development.
Technical ContextAI
Groundhogg is a WordPress-native CRM, newsletter, and marketing automation plugin published by Training Business Pros (CPE: cpe:2.3:a:trainingbusinesspros:groundhogg_-_crm,_newsletters,_and_marketing_automation:*:*:*:*:*:*:*:*). The vulnerability originates in the plugin's v3 REST API contacts endpoint (api/v3/contacts-api.php, line 287). The plugin maintains two parallel SQL construction paths: the modern Contact_Query class (contact-query.php, line 2585) which performs filter validation and escaping, and the older Legacy_Contact_Query class (legacy-contact-query.php, lines 708 and 753) which lacks equivalent protections. The root cause (CWE-89, Improper Neutralization of Special Elements Used in an SQL Command) is not a missing sanitization routine but a logic flaw in exception handling: an invalid value supplied to query[filters][0][0][type] raises a FilterException that is caught and swallowed, causing execution to fall through to the legacy path, which interpolates the attacker-controlled query[select] value directly into a SQL query without sufficient preparation or escaping.
RemediationAI
Upgrade the Groundhogg plugin to a version beyond 4.5.5 as the primary remediation. A fix commit is referenced in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3586389%40groundhogg&new=3586389%40groundhogg (changeset 3586389); however, a specific released patch version number is not independently confirmed from available data, and administrators should verify the current latest version through the WordPress plugin repository directly. As a compensating control, Wordfence's firewall may offer virtual patching coverage for premium subscribers - consult the advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4a0c04fe-7a9f-4a3f-ba2c-3bdcb5dec060 for current WAF rule status. Restricting network access to the /wp-json/gh/v3/contacts REST API endpoint is an additional compensating control but will break legitimate CRM integrations dependent on that endpoint. Auditing and minimizing which users hold Sales Representative or higher Groundhogg roles reduces the attacker pool in the interim.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today