Groundhogg CRM CVE-2026-18387

Exploitation requires a valid WordPress account with Groundhogg vendor-level role or higher - unauthenticated users and standard WordPress subscribers or editors without a Groundhogg vendor assignment cannot exploit this flaw. The attacker must additionally know to trigger the Legacy_Contact_Query fallback path by submitting a filter with an unrecognized type value (e.g., filters[0][0][type]=force_fallback), causing a FilterException; requests processed through the modern query handler are not vulnerable. The vulnerable endpoint is the Groundhogg v4 contacts API (api/v4/contacts). Limiting factors: (1) vendor-level role is a non-default Groundhogg-specific account type, not granted to ordinary WordPress users; (2) the exception-driven code path switch is a non-obvious trigger requiring specific knowledge of the plugin internals; (3) impact is data exfiltration only (C:H, I:N, A:N) - no ability to write, modify, or delete data via this vector.

The NVD-assigned CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the network-reachable, read-only data exfiltration scenario but slightly understates the exploitation barrier: PR:L maps to any low-privilege authenticated user, whereas the description specifies 'vendor-level access and above,' a Groundhogg-specific role that is elevated above basic WordPress subscriber. This narrows the realistic attacker pool to those who have obtained a vendor account - reducing opportunistic mass exploitation. There is no CISA KEV listing and no known public POC, and EPSS data was not provided; the absence of active exploitation signals keeps real-world urgency moderate despite the C:H impact. The non-obvious trigger (forcing a FilterException via an unrecognized filter type) adds practical exploitation friction not captured by AC:L, which measures environmental conditions rather than attacker knowledge. Overall, this is a medium-priority issue - significant impact if exploited, but gated by both authenticated access and knowledge of the fallback code path.

An attacker who has obtained a Groundhogg vendor-level WordPress account submits a crafted POST request to the plugin's v4 contacts API, including filters[0][0][type]=force_fallback to trigger a FilterException and route execution into the Legacy_Contact_Query handler. The attacker then appends additional SQL via the tag_query parameter - for example, injecting a UNION SELECT to retrieve WordPress user password hashes or Groundhogg contact records - extracting sensitive data from the database without triggering write-side protections. No public POC code was identified at time of analysis, but the vulnerable code lines are publicly browsable on the WordPress SVN repository.