The Groundhogg plugin for WordPress contains a SQL injection flaw in the 'search' parameter. Because the plugin does not escape or prepare the value before injecting it into a query, an attacker who can log in with a marketer-level role or higher can append arbitrary SQL statements. The attacker may then retrieve sensitive data from the database such as user credentials, contact lists, or other private information. The weakness corresponds to CWE‑89 and permits data exfiltration, leading to loss of confidentiality for anyone whose data is stored in the WordPress database.

All versions of Groundhogg up to and including 4.5.5 are affected. The vulnerability is present in the API handler file base-object-api.php and database helper files db.php and steps.php of the plugin, as referenced in the CVE. The issue is exploitable only on installations that allow users with marketer-level or higher privileges to access the search functionality, typically within a WordPress environment where Groundhogg is installed.

The CVSS v3.1 score is 6.5, indicating a medium severity. Exploitation requires a valid authenticated session with sufficient permissions, so it is not a public remote attack. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. Nevertheless, attackers with access could use the flaw to view or export sensitive database content, warranting prompt remediation.