Description

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to trigger the vulnerable Legacy_Contact_Query code path by submitting an unknown filter type (e.g. filters[0][0][type]=force_fallback), which causes a FilterException that dispatches execution away from the modern query handler.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-15T04:18:17.773Z",
  "pubdate": "2026-08-15T04:18:17.773Z",
  "executiveSummary": "The Groundhogg plugin for WordPress suffers from a generic SQL Injection vulnerability stemming from insufficient escaping and a lack of proper query preparation on the 'tag_query' parameter. This security flaw affects all versions up to and including 4.5.14. Successful exploitation of this vulnerability allows authenticated attackers possessing vendor-level access and above to manipulate existing database queries, potentially enabling the extraction of sensitive information from the underlying database. Exploiting this issue requires the attacker to trigger a specific code path, namely the Legacy_Contact_Query, which is achieved by submitting an unknown filter type such as filters[0][0][type]=force_fallback. This action intentionally forces a FilterException that redirects execution flow away from the secure, modern query handler and into the vulnerable legacy execution path. Given the requirement for vendor-level privileges, the risk is partially mitigated by access controls, but still presents a severe risk of data compromise in multi-vendor or untrusted administrative environments where privilege escalation or rogue vendors are a concern.",
  "technicalDetails": "The vulnerability resides in the Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress across all versions up to, and including, 4.5.14. The root cause of the issue is the inadequate sanitization and escaping of user-supplied input provided via the 'tag_query' parameter, combined with the absence of proper SQL statement preparation within the database query logic.\nSpecifically, the attack mechanism relies on forcing the application to execute the vulnerable Legacy_Contact_Query code path instead of utilizing the modern, secure query handler. An authenticated attacker with vendor-level access or higher initiates this state by supplying a maliciously crafted HTTP request containing an unknown filter type, specifically passing filters[0][0][type]=force_fallback. This deliberate parameter manipulation triggers a FilterException during the query parsing phase. As a result of this exception handling, the application dispatches execution away from the modern query handler and falls back to the legacy codebase.\nWithin the Legacy_Contact_Query code path, the 'tag_query' parameter is processed and concatenated directly into the active database query without adequate escaping or parameterization. Because the input lacks robust escaping and the query lacks proper preparation, the attacker can break out of the intended SQL statement context. This allows the attacker to append arbitrary SQL commands and subqueries to the already existing database queries.\nThe network exposure is bounded by the WordPress application layer, requiring the attacker to authenticate with at least vendor-level privileges. Once the legacy code path is triggered and the malicious SQL payload is injected, the payload behavior enables the execution of database operations determined by the attacker. The post-exploitation impact includes the unauthorized extraction of sensitive information residing in the WordPress database, which may comprise user data, customer records, and internal system configurations."
}