CVE-2026-18387

Name of the Vulnerable Software and Affected Versions Groundhogg versions prior to 4.5.15

Description The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with vendor-level access or higher can append malicious SQL queries to existing ones to extract sensitive database information. This occurs due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. The issue is triggered when an unknown filter type is submitted, causing a FilterException that redirects execution to the vulnerable Legacy Contact Query code path. The affected parameter is tag query.

Recommendations Update to version 4.5.15 or later. As a temporary mitigation, restrict access to the tag query parameter for users with vendor-level permissions.