CVE-2026-18387 in Groundhogg Plugin
Summary
by MITRE • 08/15/2026
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to trigger the vulnerable Legacy_Contact_Query code path by submitting an unknown filter type (e.g. filters[0][0][type]=force_fallback), which causes a FilterException that dispatches execution away from the modern query handler.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The Groundhogg plugin represents a comprehensive customer relationship management solution for WordPress environments, offering features including newsletter management and marketing automation capabilities. This vulnerability affects all versions up to and including 4.5.14, creating a critical security exposure within WordPress installations that rely on this plugin for their marketing operations. The flaw resides in the handling of user-supplied parameters within the tag_query functionality, specifically targeting the Legacy_Contact_Query code path that serves as a fallback mechanism for certain filter types.
The technical exploitation occurs through a classic SQL injection vulnerability where insufficient input sanitization allows attackers to manipulate database queries through the tag_query parameter. This weakness stems from inadequate escaping of user-provided data combined with insufficient preparation of existing SQL statements, creating an environment where malicious input can be seamlessly integrated into database operations. The vulnerability specifically impacts authenticated attackers who possess vendor-level access or higher privileges within the WordPress installation, as they can leverage this weakness to execute unauthorized database operations.
The operational impact of this vulnerability extends beyond simple data extraction, potentially allowing attackers to access sensitive customer information, user credentials, and marketing data stored within the plugin's database tables. The attack vector requires triggering a specific code path through the submission of unknown filter types such as filters[0][0][type]=force_fallback, which causes a FilterException and redirects execution flow away from the modern query handler. This design flaw creates a bypass mechanism that circumvents normal input validation procedures, effectively opening a backdoor for database manipulation.
This vulnerability aligns with CWE-89, which categorizes SQL injection flaws as critical weaknesses in software applications, and demonstrates characteristics consistent with ATT&CK technique T1078 for valid accounts and T1566 for credential access through exploitation of web application vulnerabilities. The attack requires minimal privileges but maximum impact, making it particularly dangerous within environments where the vendor role typically grants broad administrative capabilities. Organizations using Groundhogg plugin versions up to 4.5.14 should immediately implement mitigations including patching to newer versions, input validation enforcement, and monitoring for unauthorized access attempts.
The recommended mitigation strategy involves upgrading to patched versions of the Groundhogg plugin, implementing proper parameter sanitization measures, and establishing database query auditing procedures. Security teams should also consider implementing web application firewalls to detect and block suspicious SQL injection patterns, along with regular security assessments of WordPress installations to identify similar vulnerabilities across other plugins and themes. The vulnerability demonstrates the critical importance of input validation in database interactions and highlights the need for comprehensive security testing throughout the software development lifecycle.