Groundhogg — CRM, Newsletters, and Marketing Automation

Groundhogg through 4.7.1 has a path-traversal flaw in import_contacts. The CNA vector requires low-privilege authenticated access and rates the impact as high confidentiality loss, without user interaction. The specific WordPress role is not established.

Groundhogg through 4.5.14 uses the attacker-controlled tag_query value unsafely when the legacy contact query path is selected. A plugin vendor-level user can submit an unknown filter type such as filters[0][0][type]=force_fallback, causing FilterException to move execution from the modern handler to Legacy_Contact_Query, where SQL is insufficiently prepared. The attacker can append SQL and extract database information. The exact endpoint and final query are not disclosed.

Groundhogg through 4.5.2 protects GET /wp-json/gh/v4/contacts/ only with the broad view_contacts capability. read_single() accepts a sequential contact ID without applying the object-level view_contact ownership check used elsewhere. A user with view_contacts but not view_others_contacts, notably the built-in Sales Rep role, can enumerate every contact and retrieve PII, contact metadata, owner IDs, administrator edit URLs and linked WordPress users' capability sets.

Groundhogg is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 4.4.1.

Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.8.

Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.5.

Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.5.

Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 4.5.

Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.4.

Groundhogg is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a to < 4.4.1.

Groundhogg is affected by arbitrary file deletion. Exposure depends on how the affected operation is made reachable by the site. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 4.4.

Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Groundhogg is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Groundhogg is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg is affected by code execution. Exploitation requires an authenticated administrator account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Groundhogg is affected by cross-site scripting. Exploitation requires an authenticated administrator account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg is affected by dangerous file upload. Exploitation requires an authenticated author account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Groundhogg is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Groundhogg is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Groundhogg is affected by cross-site request forgery. Exploitation requires an authenticated WordPress account. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Groundhogg is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Groundhogg is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Groundhogg is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Groundhogg is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Groundhogg is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Groundhogg is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.