Groundhogg — CRM, Newsletters, and Marketing Automation CVE Vulnerabilities

Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping

high ✓ patched

cve id CVE-2026-109221 ↗

cvss score 8.1

cwe CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

published Oct 15, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.

Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter

high ✓ patched

cve id CVE-2026-18548 ↗

cvss score 7.2

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Oct 14, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion

high ✓ patched

cve id CVE-2026-92975 ↗

cvss score 8.1

cwe CWE-269: Improper Privilege Management

published Oct 9, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by matching against publicly hardcoded constants — `user_login` `'groundhogg'` and email addresses `'[email protected]'` / `'[email protected]'` — where the `in_array()` email-equality check at line 238 is not a security boundary because any user fully controls their own email value. This makes it possible for an attacker with an account whose `user_login` is `'groundhogg'` and whose `user_email` matches one of the hardcoded support constants to have that account silently promoted to administrator — and additionally to super admin on multisite when the triggering administrator holds `manage_network_options` — resulting in full site takeover. Exploitation requires a two-actor flow: the attacker must first obtain or pre-plant an account with the hardcoded credentials (possible when open user registration is enabled or another account-creation path exists), after which a legitimate administrator must invoke the support-access feature via the `submit_ticket` or `process_send_support_access` entry points to trigger the promotion.

Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter

high ✓ patched

cve id CVE-2026-104725 ↗

cvss score 8.8

cwe CWE-269: Improper Privilege Management

published Oct 9, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the `user` parameter within the `process_edit()` function, which allows any authenticated user with the `edit_contacts` capability to reassign a contact record's linked WordPress user ID to any arbitrary account without requiring the `edit_users` or `promote_users` capabilities. This makes it possible for authenticated attackers, with sales_rep-level access and above, to escalate their privileges to administrator by linking a contact to an administrator's WordPress user ID, then creating a note containing the `{auto_login_link}` replacement tag to trigger generation of a valid auto-login permissions-key URL for the administrator-linked contact, and finally visiting that URL to authenticate as the targeted administrator. The auto-login URL is stored in the note content and is readable back by the attacker via the `view_notes` and `add_notes` capabilities that the sales_rep role holds by default.

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Unauthenticated Information Exposure

medium ✓ patched

cve id CVE-2026-104385 ↗

cvss score 5.3

cwe CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

published Oct 5, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.8.3. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Authenticated (Custom Role+) SQL Injection

medium ✓ patched

cve id CVE-2026-104408 ↗

cvss score 6.5

cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

published Oct 5, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.8.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom role-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test

high ✓ patched

cve id CVE-2026-97644 ↗

cvss score 8.8

cwe CWE-269: Improper Privilege Management

published Oct 2, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator.

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.7.1 - Authenticated (Import_contacts+) Path Traversal

medium ✓ patched

cve id CVE-2026-85310 ↗

cvss score 6.5

cwe CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

published Sep 9, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.7.1. This is due to insufficient validation of a user supplied path. This makes it possible for authenticated attackers, with import_contacts-level access and above, to access files and directories outside of the intended directory.

Groundhogg — CRM, Newsletters, and Marketing Automation < 4.7.2 - Unauthenticated Open Redirect

medium ✓ patched

cve id CVE-2026-81741 ↗

cvss score 6.1

cwe CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

published Sep 7, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Open Redirect in all versions up to 4.7.2 (exclusive). This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

Groundhogg — CRM, Newsletters, and Marketing Automation < 4.5.13 - Unauthenticated Stored Cross-Site Scripting

high ✓ patched

cve id CVE-2026-81660 ↗

cvss score 7.2

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Aug 31, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 4.5.13. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter

medium ✓ patched

cve id CVE-2026-18387 ↗

cvss score 6.5

cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

published Aug 14, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to trigger the vulnerable Legacy_Contact_Query code path by submitting an unknown filter type (e.g. filters[0][0][type]=force_fallback), which causes a FilterException that dispatches execution away from the modern query handler.

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference

medium ✓ patched

cve id CVE-2026-11454 ↗

cvss score 6.5

cwe CWE-639: Authorization Bypass Through User-Controlled Key

published Aug 4, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/<id> REST endpoint. The endpoint's permission callback checks only the role-level view_contacts capability and read_single() returns the full contact record by sequential integer ID without the object-level view_contact ownership check applied elsewhere in the codebase. This makes it possible for authenticated attackers holding view_contacts but not view_others_contacts — notably Groundhogg's built-in Sales Rep role, designed to see only its own contacts — to read any contact record on the site, including PII, contact meta, owner IDs, the admin edit URL, and (for contacts linked to a WordPress user) that user's full capability set.

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion

high ✓ patched

cve id CVE-2026-57389 ↗

cvss score 8.1

cwe CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

published Jul 8, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 4.4.1. This makes it possible for authenticated attackers, with Custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter

medium ✓ patched

cve id CVE-2026-14029 ↗

cvss score 6.5

cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

published Jul 1, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in all versions up to, and including, 4.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to hold a Groundhogg custom role with the view_contacts capability, which is granted by default to several built-in Groundhogg roles above the base subscriber level.

Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter

medium ✓ patched

cve id CVE-2026-13333 ↗

cvss score 6.5

cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

published Jun 26, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via 'query[select]' Parameter in all versions up to, and including, 4.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Sales Representative-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitized Contact_Query code path can be bypassed by supplying an invalid filter type (e.g., query[filters][0][0][type]=invalid_filter_nonexistent), causing a FilterException to be caught and execution to fall through to the unsanitized Legacy_Contact_Query path.

Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter

medium ✓ patched

cve id CVE-2026-13331 ↗

cvss score 6.5

cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

published Jun 26, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'search' parameter in all versions up to, and including, 4.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with marketer-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection

medium ✓ patched

cve id CVE-2026-57667 ↗

cvss score 6.5

cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

published Jun 26, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with sales representative-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter

medium ✓ patched

cve id CVE-2026-13226 ↗

cvss score 6.5

cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

published Jun 25, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Sales Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler wp_ajax_groundhogg_get_contacts_table has its capability check commented out and performs no nonce verification, meaning any authenticated user regardless of role can reach the vulnerable code path.

Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization

medium ✓ patched

cve id CVE-2026-40793 ↗

cvss score 4.3

cwe CWE-862: Missing Authorization

published Apr 24, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 4.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion

high ✓ patched

cve id CVE-2026-40727 ↗

cvss score 8.1

cwe CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

published Apr 16, 2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 4.4. This makes it possible for authenticated attackers, with Custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection

medium ✓ patched

cve id CVE-2025-12750 ↗

cvss score 4.9

cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

published Nov 20, 2025

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection via the 'term' parameter in all versions up to, and including, 4.2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Groundhogg <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

medium ✓ patched

cve id CVE-2025-64367 ↗

cvss score 6.4

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Oct 31, 2025

The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection

high ✓ patched

cve id CVE-2025-54053 ↗

cvss score 7.5

cwe CWE-502: Deserialization of Untrusted Data

published Aug 5, 2025

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload

high ✓ patched

cve id CVE-2025-48300 ↗

cvss score 8.8

cwe CWE-434: Unrestricted Upload of File with Dangerous Type

published Jul 4, 2025

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with sales rep-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion

high ✓ patched

cve id CVE-2025-4206 ↗

cvss score 7.2

cwe CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

published May 8, 2025

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'process_export_delete' and 'process_import_delete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter

medium ✓ patched

cve id CVE-2025-1267 ↗

cvss score 5.5

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Mar 31, 2025

The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function

high ✓ patched

cve id CVE-2025-0394 ↗

cvss score 8.8

cwe CWE-434: Unrestricted Upload of File with Dangerous Type

published Jan 13, 2025

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions up to, and including, 3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.