Executive brief
Groundhogg is a WordPress plugin used for customer relationship management (CRM) and marketing automation. A security vulnerability in this plugin allows authorized users, such as sales representatives, to bypass security filters and run unauthorized database commands. This could lead to the exposure of sensitive customer information and internal business data stored in the website's database.
Technical details
This vulnerability is a generic SQL injection located in the 'query[select]' parameter of the Groundhogg plugin. The root cause is insufficient escaping of user-supplied parameters and a lack of SQL query preparation. An attacker can bypass the sanitized Contact_Query code path by providing an invalid filter type (e.g., query[filters][0][0][type]=invalid_filter_nonexistent), which triggers a FilterException. This exception causes the execution to fall through to the unsanitized Legacy_Contact_Query path. Exploitation requires network access and at least Sales Representative-level authentication, allowing the attacker to append arbitrary SQL queries and extract sensitive data.
Affected products
- trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation up to, and including, 4.5.5
Timeline
- 2026-06-27: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.5/api/v3/contacts-api.php
- https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.5/includes/contact-query.php
- https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.5/includes/legacy-contact-query.php
- https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.5/includes/legacy-contact-query.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3586389%40groundhogg&new=3586389%40groundhogg&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4a0c04fe-7a9f-4a3f-ba2c-3bdcb5dec060?source=cve