Groundhogg, a WordPress CRM and marketing automation plugin, contains an SQL injection flaw in the 'after' parameter that allows an authenticated attacker with Sales Manager or higher privileges to inject arbitrary SQL statements and extract sensitive database contents. The vulnerability arises from insufficient escaping and the absence of prepared statements, enabling attackers to append malicious queries to the existing SQL. This flaw can lead to the compromise of confidential user data and possibly broader system integrity if attackers coerce the database to produce unintended results.

All installations of Groundhogg version 4.5.4 and earlier are affected. The issue resides in the wp_ajax_groundhogg_get_contacts_table AJAX handler, which is publicly accessible to any authenticated user because its capability checks are commented out and it lacks nonce verification. Users with roles that include Sales Manager rights or higher are at risk.

The vulnerability carries a CVSS score of 6.5, indicating a moderate severity. No EPSS score is reported, so the exploitation likelihood is unclear from public data, and it is not listed in the CISA KEV catalog. The likely attack vector is via an authenticated WordPress session where the attacker can send crafted POST requests to the vulnerable AJAX endpoint. If successful, the attacker can read or exfiltrate database information. No additional prerequisites beyond legitimate authentication are required, suggesting that any site with the plugin and exposed user accounts is potentially vulnerable.