The Groundhogg CRM plugin for WordPress contains a classic SQL injection flaw in the 'select' parameter used by its API endpoints. Because the value supplied by the user is not properly escaped and the existing SQL statements are not prepared, an attacker who can supply this parameter can inject arbitrary SQL text. The injected statements become part of an already constructed query, allowing the attacker to read or potentially modify data in the WordPress database. This vulnerability can be leveraged by anyone who has a custom‑level or higher Groundhogg role with the view_contacts capability, which is granted by default to several built‑in roles. The resulting data exposure may include contact lists, personal information in the plugin’s tables.

WordPress installations running any version of the Groundhogg plugin up to and including 4.5.8 are affected. The vulnerability resides in the plugin’s base-object-api.php and database query files, meaning that any site that has installed Groundhogg 4.5.8 or earlier and has the default advanced roles is vulnerable. Sites that have upgraded to 4.5.9 or later have the fix applied.

The CVSS score of 6.5 places the flaw in the medium severity range, and the EPSS score of less than 1% suggests that exploitation is uncommon at present. Nevertheless, because the attack requires authentication that is likely present on many sites, and because the vulnerability allows the extraction of arbitrary data, the risk to confidentiality is high. The vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation campaigns, but the relatively low projected exploitation likelihood does not diminish the need for remediation. The attack vector is remote via the plugin’s REST‑API endpoints that accept the 'select' parameter.