Groundhogg CRM CVE-2026-14029

Exploitation requires the attacker to hold an authenticated WordPress account assigned a Groundhogg plugin role that carries the view_contacts capability. This capability is granted by default to multiple built-in Groundhogg roles above the base subscriber level (e.g., roles such as sales agent or marketing manager depending on plugin configuration), but is NOT present on standard WordPress roles (administrator, editor, author, contributor, subscriber) unless explicitly supplemented with Groundhogg capabilities. The attack is limited to: (1) authenticated users only - unauthenticated exploitation is not possible per CVSS PR:L; (2) accounts that have been explicitly assigned a qualifying Groundhogg role; (3) network access to the WordPress REST API endpoint that accepts the 'select' parameter. Integrity and availability are not affected, confining the exploit to data exfiltration. The non-default role requirement limits exposure in minimal or single-operator WordPress installations but represents a realistic threat in team-based or agency deployments.

The NVD CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the real-world risk profile: the attack is network-accessible and low-complexity but gated behind low-privilege authentication. The PR:L constraint is meaningful - exploitation requires a valid WordPress account carrying a Groundhogg-specific role with the view_contacts capability, which is assigned by default to several built-in Groundhogg roles above subscriber but is not the default for standard WordPress roles. This privilege barrier is non-trivial in targeted environments but becomes exploitable if Groundhogg roles are broadly distributed (e.g., sales teams, marketing staff). No EPSS score was provided; no CISA KEV listing exists; and no public proof-of-concept exploit has been identified, all of which reduce urgency relative to the CVSS score alone. The confidentiality impact is high - successful exploitation can yield the full contents of the WordPress database, including contact PII, email campaign data, credentials, and CRM records - but integrity and availability are unaffected. Real-world priority is moderate: elevated in multi-user or agency-hosted WordPress environments where Groundhogg roles are broadly assigned, but lower in tightly controlled single-operator deployments.

A sales team member or marketing user holding a Groundhogg role with the view_contacts capability sends a crafted HTTP request to the Groundhogg REST API endpoint with a manipulated 'select' parameter containing appended SQL - for example, injecting a UNION SELECT statement to pull WordPress user hashes or contact PII from the database. The query builder in db/query/query.php passes the unsanitized value directly into the SQL string, and the database executes the combined query, returning exfiltrated records in the API response. No public proof-of-concept has been released, but the vulnerable lines are publicly visible in the plugin repository at the referenced line numbers, significantly reducing the time required for an attacker to develop working exploit code.