Groundhogg is a WordPress plugin that suffers from a deserialization vulnerability when handling untrusted data. The flaw allows an attacker to inject a PHP object during deserialization, which can lead to arbitrary code execution or unauthorized actions within the web application. This vulnerability is classified as CWE‑502, indicating that untrusted data is being deserialized without validation.

Adrian Tobey Groundhogg is affected in all releases from the earliest available version through and including 4.2.2. The plugin can be installed on any WordPress site that includes it, regardless of WordPress version, meaning potentially every site running the plugin version 4.2.2 or earlier is vulnerable.

The CVSS score of 6.6 marks the vulnerability as medium severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, involving a crafted HTTP request that submits a serialized payload to a plugin endpoint. An attacker would need access to the web application’s request handling for the plugin, which is typically exposed to public users, making the risk materializable if the threat actor can craft and send the payload.