EUVD-2026-39671
GHSA-5972-j8hw-jxcr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Network-reachable SQLi requiring the Sales Representative role (PR:L) with no user interaction; scope changes to the shared DB, high confidentiality, no integrity, low availability per vendor data.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
1DescriptionCVE.org
Sales Representative SQL Injection in Groundhogg <= 4.5 versions.
AnalysisAI
SQL injection in the Groundhogg WordPress CRM/marketing-automation plugin (versions <= 4.5) allows an authenticated low-privileged user holding the Sales Representative role to inject arbitrary SQL into a database query, exposing sensitive data across the WordPress installation. The CVSS 3.1 base score is 8.5 (High) with a scope change, reflecting that compromise of the plugin's data layer reaches beyond its own privilege boundary. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS value supplied in the source data.
Technical ContextAI
Groundhogg is a self-hosted CRM, email-marketing and sales-automation plugin for WordPress that stores contacts, pipelines and campaign data in the WordPress MySQL/MariaDB database. The flaw is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reachable by the Sales Representative role is concatenated into a SQL statement without adequate parameterization or escaping. Because Groundhogg shares the host WordPress database (wp_ tables plus its own contact/event tables), a successful injection can read data well beyond the CRM's intended scope, which is consistent with the Scope:Changed metric in the supplied CVSS vector. No CPE strings were provided in the input, so exact affected configurations beyond the plugin version range are not enumerated.
RemediationAI
No vendor-released patch version is identified in the supplied data; the only reference is the Patchstack database entry (https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-5-sql-injection-vulnerability?_s_id=cve), which should be checked for the fixed release, and administrators should update Groundhogg to the latest available version above 4.5 once confirmed by the vendor. Until a confirmed fixed version is applied, restrict assignment of the Sales Representative role to trusted users only and audit existing accounts holding it, since the vulnerability requires that privilege level - this reduces the attacker pool but does not remove the flaw. As compensating controls, place a WAF or virtual patch (Patchstack offers one for this entry) in front of the affected endpoint to filter SQL-injection payloads, and consider temporarily disabling or removing the Groundhogg plugin if the Sales Representative workflow is not in active use, accepting the trade-off of losing CRM functionality. Restrict and monitor database accounts so the WordPress DB user has least privilege, limiting the blast radius of any successful read.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today