Groundhogg CRM EUVD-2026-39615

Exploitation requires a valid WordPress authenticated session at any role level - subscriber, contributor, author, editor, or administrator - because the wp_ajax_groundhogg_get_contacts_table handler's capability check is commented out and no nonce is verified. The Groundhogg plugin must be installed and active on the target WordPress site at version 4.5.4 or earlier. No specific non-default configuration is required beyond plugin installation. What limits exploitation: the attacker must hold any authenticated account on the WordPress site; exploitation against sites with closed user registration requires credential theft or social engineering first. The attack surface is limited to data exfiltration (read-only SQL injection) and does not appear to enable write operations or remote code execution based on available description. The CVSS vector PR:L reflects the authenticated-user requirement, but the effective bar is lower than 'Sales Manager' as the CVE description initially implies.

The provided CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-accessible, low-complexity, low-privilege SQL injection with high confidentiality impact and no integrity or availability impact. In practice, the risk is somewhat higher than the score implies: the capability check being commented out means the effective privilege requirement is any authenticated WordPress user, not a Sales Manager role, which on sites with open user registration approaches a near-unauthenticated condition. The impact is confined to data exfiltration (C:H) - the injection pattern described is read-only ('extract sensitive information'), consistent with a stacked/blind read rather than write capability. No EPSS data was provided in the input and this CVE is not listed in CISA KEV, meaning active exploitation is not confirmed. The Wordfence changeset reference (revision 3585561) suggests a patch was committed upstream, which partially reduces urgency. However, CRM databases in Groundhogg deployments routinely contain customer PII, email lists, and marketing analytics - making exfiltration highly impactful for affected businesses. The discrepancy between the CVE description's 'Sales Manager-level' qualifier and the actual commented-out capability check is notable: defenders should treat the real bar as any authenticated user, not Sales Manager.

An attacker registers or otherwise obtains any authenticated WordPress account (including subscriber-level) on a target site running Groundhogg 4.5.4 or earlier. The attacker then sends a crafted POST request to wp-admin/admin-ajax.php with action=groundhogg_get_contacts_table and an SQL-injected value in the 'after' parameter, bypassing the commented-out capability check and absent nonce verification. The injected SQL appends additional SELECT clauses, enabling the attacker to read arbitrary database tables including WordPress user credentials, contact PII, and CRM data. No public POC code has been identified at time of analysis.