The Groundhogg plugin for WordPress has a SQL injection flaw in the 'term' parameter resulting from inadequate escaping and lack of prepared statements. Administrators or higher users can submit crafted input that appends additional SQL statements to existing queries, enabling the reading of sensitive database contents such as user credentials, content, and other private information.

All WordPress installations using the Groundhogg plugin up through version 4.2.6.1, delivered by trainingbusinesspros, are affected. Sites that have updated beyond 4.2.6.1 are not vulnerable, and the issue does not exist in other WordPress plugins.

The CVSS base score of 4.9 classifies the vulnerability as moderate, and the EPSS score of less than 1% indicates a low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. An attacker must have authenticated Administrator-level access and must be able to interact with the WordPress admin interface or a route that exposes the vulnerable 'term' parameter to inject malicious SQL.