The Groundhogg plugin for WordPress is vulnerable to a classic SQL injection via the tag_query parameter. The vulnerability arises from inadequate escaping and the absence of prepared statements, allowing attackers with vendor-level permissions or higher to inject arbitrary SQL into existing queries. Successful exploitation can reveal sensitive database contents, leading to data theft or further compromise.

Vendors: trainingbusinesspros; Product: Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress. All versions up to and including 4.5.14 are affected. The vulnerability exists in the legacy query handling code paths triggered by malformed filter inputs.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access at the vendor role level or above, so the risk is limited to environments where such privileged users exist. Once accessed, an attacker can append additional SQL commands to retrieve any database data.