What is the CVSS score of EUVD-2026-92314?

EUVD-2026-92314 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Groundhogg are affected by EUVD-2026-92314?

Groundhogg WordPress plugin versions through 4.8.3 have a blind SQL injection issue that could let an authenticated high-privilege user extract data from the site’s WordPress database, affecting…

How to fix or mitigate EUVD-2026-92314?

Within 24 hours, inventory all WordPress instances running Groundhogg through version 4.8.3 and identify every account with administrator or Groundhogg admin capabilities; restrict those accounts to named trusted personnel, enforce strong authentication and MFA, and review database and plugin logs for anomalous query activity. Within 7 days, apply interim mitigations such as least-privilege role adjustments, temporary deactivation of Groundhogg if not business-critical, and virtual patching or WAF rules targeting SQL injection patterns, while confirming the vendor advisory and monitoring for a patch. Within 30 days, re-audit Groundhogg admin permissions, validate that no unauthorized data extraction occurred, and prepare to test and deploy a vendor-released patch as soon as it becomes available for versions after 4.8.3, since no vendor-released patch identified at time of analysis.

Groundhogg EUVD-2026-92314

| CVE-2026-104408 HIGH

SQL Injection (CWE-89)

2026-10-05 Patchstack

GHSA-hp64-fhfc-6fxp

WordPress SQLi Groundhogg Wordpress Plugin

7.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

4.9 MEDIUM

Network-reachable blind SQLi needing an authenticated high-privilege account (PR:H); primarily enables database read (C:H), with no demonstrated write or availability impact, and I treat DB access as same-authority (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 05, 2026 - 09:33 vuln.today

CVE Published

Oct 05, 2026 - 08:44 cve.org

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injection.This issue affects Groundhogg: from n/a through 4.8.3.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 15 High Severity Oct 06, 2026

AnalysisAI

Blind SQL injection in the Groundhogg WordPress plugin (versions through 4.8.3) allows an authenticated high-privilege user - an administrator, or any account granted Groundhogg admin capabilities - to inject SQL into a plugin query and extract data from the underlying WordPress database. The flaw is network-reachable with low attack complexity and requires no victim interaction, but the PR:H metric means an attacker must already hold elevated credentials, which sharply limits who can exploit it; there is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated WordPress session with a high-privilege role (administrator or a role granted Groundhogg admin capabilities), per the CVSS PR:H metric, on a site running the Groundhogg plugin at version 4.8.3 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine but conditional risk rather than a drop-everything emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version is confirmed in the available input data - only that the affected range extends through 4.8.3 - so the first step is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-8-3-sql-injection-vulnerability?_s_id=cve) for the exact fixed release and upgrade to it as soon as it is published; Groundhogg updates ship through the standard WordPress plugin updater, and if the advisory names a specific patched version, deploy exactly that version rather than assuming 4.8.4. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress instances running Groundhogg through version 4.8.3 and identify every account with administrator or Groundhogg admin capabilities; restrict those accounts to named trusted personnel, enforce strong authentication and MFA, and review database and plugin logs for anomalous query activity. …

Threat intelligence, references, and detailed analysis are available after sign-in.