WordPress security by component

groundhogg

Plugin description

groundhogg is a WordPress component with 30 published CVE records in this archive. The latest tracked vulnerability was published Aug 15, 2026; the highest published CVSS base score is 9.1.

Plugin slug: groundhogg

Latest vulnerability

CVE-2026-18387: Groundhogg fallback tag_query permits vendor-role SQL injection

Groundhogg through 4.5.14 uses the attacker-controlled tag_query value unsafely when the legacy contact query path is selected. A plugin vendor-level user can submit an unknown filter type such as filters[0][0][type]=force_fallback, causing FilterException to move execution from the modern handler to Legacy_Contact_Query, where SQL is insufficiently prepared. The attacker can append SQL and extract database information. The exact endpoint and final query are not disclosed.

PublishedAug 15, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for groundhogg
		Safe version
Aug 15, 2026	CVE-2026-18387 Groundhogg fallback tag_query permits vendor-role SQL injection Groundhogg through 4.5.14 uses the attacker-controlled tag_query value unsafely when the legacy contact query path is selected. A plugin vendor-level user can submit an unknown filter type such as filters[0][0][type]=force_fallback, causing FilterException to move execution from the modern handler to Legacy_Contact_Query, where SQL is insufficiently prepared. The attacker can append SQL and extract database information. The exact endpoint and final query are not disclosed.	See mitigation notes	CVE6.5 NVDPending
Aug 05, 2026	CVE-2026-11454 Groundhogg Sales Reps can read every CRM contact through REST Groundhogg through 4.5.2 protects GET /wp-json/gh/v4/contacts/ only with the broad view_contacts capability. read_single() accepts a sequential contact ID without applying the object-level view_contact ownership check used elsewhere. A user with view_contacts but not view_others_contacts, notably the built-in Sales Rep role, can enumerate every contact and retrieve PII, contact metadata, owner IDs, administrator edit URLs and linked WordPress users' capability sets.	4.5.3	CVE6.5 NVDPending
Jul 13, 2026	CVE-2026-57389 Groundhogg: Filesystem traversal Groundhogg is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 4.4.1. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	4.5	CVE8.6 NVDPending
Jul 02, 2026	CVE-2026-14029 Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.8.	See mitigation notes	CVE6.5 NVDPending
Jun 27, 2026	CVE-2026-13333 Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.5. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.5 NVDPending
Jun 27, 2026	CVE-2026-13331 Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.5.	See mitigation notes	CVE6.5 NVDPending
Jun 26, 2026	CVE-2026-57667 Groundhogg: SQL injection Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 4.5. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	4.5.1	CVE8.5 NVDPending
Jun 26, 2026	CVE-2026-13226 Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.4.	See mitigation notes	CVE6.5 NVDPending
Jun 15, 2026	CVE-2026-40793 Groundhogg: Broken access control Groundhogg is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a to < 4.4.1. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	4.4.1	CVE6.5 NVDPending
Jun 15, 2026	CVE-2026-40727 Groundhogg: Arbitrary file deletion Groundhogg is affected by arbitrary file deletion. Exposure depends on how the affected operation is made reachable by the site. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 4.4. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	4.4.1	CVE7.7 NVDPending
Oct 31, 2025	CVE-2025-64367 Groundhogg: Cross-site scripting Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.5 NVDPending
Aug 20, 2025	CVE-2025-54053 Groundhogg: Code execution Groundhogg is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.6 NVDPending
Jul 16, 2025	CVE-2025-48300 Groundhogg: Dangerous file upload Groundhogg is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE9.1 NVDPending
May 09, 2025	CVE-2025-4206 WordPress CRM, Email & Marketing Automation for WordPress \| Award Winner — Groundhogg: Code execution WordPress CRM, Email & Marketing Automation for WordPress \| Award Winner — Groundhogg is affected by code execution. Exploitation requires an authenticated administrator account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE7.2 NVDPending
Apr 01, 2025	CVE-2025-1267 Groundhogg: Cross-site scripting Groundhogg is affected by cross-site scripting. Exploitation requires an authenticated administrator account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.5 NVDPending
Jan 14, 2025	CVE-2025-0394 WordPress CRM, Email & Marketing Automation for WordPress \| Award Winner — Groundhogg: Dangerous file upload WordPress CRM, Email & Marketing Automation for WordPress \| Award Winner — Groundhogg is affected by dangerous file upload. Exploitation requires an authenticated author account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE8.8 NVDPending
Jan 07, 2025	CVE-2024-56289 Groundhogg: Cross-site scripting Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE7.1 NVDPending
Jan 02, 2025	CVE-2024-37235 Groundhogg: Cross-site request forgery Groundhogg is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE4.3 NVD4.3
Jul 22, 2024	CVE-2024-37264 Groundhogg: Cross-site scripting Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE7.1 NVD6.1
Nov 09, 2023	CVE-2023-34178 Groundhogg: Cross-site request forgery Groundhogg is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.4 NVD8.8
Nov 03, 2023	CVE-2023-34179 Groundhogg: SQL injection Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE7.6 NVD7.2
Oct 31, 2023	CVE-2023-40681 Groundhogg: Cross-site scripting Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.9 NVD4.8
May 20, 2023	CVE-2023-2736 Groundhogg: Cross-site request forgery Groundhogg is affected by cross-site request forgery. Exploitation requires an authenticated WordPress account. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE7.5 NVD8.0
May 20, 2023	CVE-2023-2735 Groundhogg: Cross-site scripting Groundhogg is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE4.9 NVD5.4
May 20, 2023	CVE-2023-2717 Groundhogg: Cross-site request forgery Groundhogg is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.4 NVD4.3
May 20, 2023	CVE-2023-2716 Groundhogg: A security weakness Groundhogg is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.4 NVD5.4
May 20, 2023	CVE-2023-2715 Groundhogg: A security weakness Groundhogg is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE4.3 NVD4.3
May 20, 2023	CVE-2023-2714 Groundhogg: A security weakness Groundhogg is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE4.3 NVD4.3
Apr 10, 2023	CVE-2023-1425 WordPress CRM, Email & Marketing Automation for WordPress \| Award Winner — Groundhogg: SQL injection WordPress CRM, Email & Marketing Automation for WordPress \| Award Winner — Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE7.2 NVD7.2
Aug 27, 2019	CVE-2019-15647 Groundhogg: Code execution Groundhogg is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVEPending NVD8.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers