Jonathan Dersch

**Name of the Vulnerable Software and Affected Versions** Groundhogg versions prior to 4.5.15 **Description** The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with vendor-level access or higher can append malicious SQL queries to existing ones to extract sensitive database information. This occurs due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. The issue is triggered when an unknown filter type is submitted, causing a `FilterException` that redirects execution to the vulnerable `Legacy Contact Query` code path. The affected parameter is `tag query`. **Recommendations** Update to version 4.5.15 or later. As a temporary mitigation, restrict access to the `tag query` parameter for users with vendor-level permissions.