CVE-2026-14029 Overview
CVE-2026-14029 is a SQL Injection vulnerability in the Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress. The flaw affects all versions up to and including 4.5.8 and stems from insufficient escaping of the select parameter combined with missing query preparation. Authenticated attackers holding a Groundhogg custom role with the view_contacts capability can append additional SQL to existing queries. The vulnerability maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated attackers with custom-level access can extract sensitive data — including contact records, credentials, and configuration — from the WordPress database through crafted select parameter values.
Affected Products
- Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress
- All plugin versions up to and including 4.5.8
- WordPress sites where the view_contacts capability has been granted to non-administrative roles
Discovery Timeline
- 2026-07-02 - CVE-2026-14029 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-14029
Vulnerability Analysis
The vulnerability resides in Groundhogg's REST API base object handler and the underlying database query builder. The select parameter accepted by the API is passed through to SQL query construction without proper sanitization or parameterized binding. As a result, attacker-controlled input becomes part of the executed SQL statement.
Exploitation requires an authenticated session with the view_contacts capability. Several built-in Groundhogg roles above the base subscriber level receive this capability by default, which broadens the pool of accounts capable of triggering the flaw. Successful exploitation permits UNION-based or stacked query techniques that extract arbitrary data from the WordPress database, including user credentials stored in wp_users and secrets residing in wp_options.
Root Cause
The root cause is the direct interpolation of the user-supplied select value into SQL statements without escaping or use of prepared statements. The affected code paths are documented in the plugin sources at api/v4/base-object-api.php (line 505), db/db.php (line 1366), and db/query/query.php (lines 228 and 427). See the Groundhogg API Base Object Code and Groundhogg Query Code.
Attack Vector
The attack vector is network-based against the plugin's REST API endpoint. An authenticated user submits a request that includes a crafted select parameter containing SQL syntax. The plugin appends this input to the outgoing query, causing the database engine to execute the injected clause. Because the attacker only needs contact-viewing privileges, compromise of a low-tier account or self-registration in environments with permissive role assignment is sufficient. Refer to the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-14029
Indicators of Compromise
- Unexpected HTTP requests to Groundhogg REST API endpoints under /wp-json/gh/v4/ containing SQL keywords (UNION, SELECT, SLEEP, --, /*) in the select parameter.
- Anomalous response times on API endpoints, indicating possible time-based blind SQL injection attempts.
- Access log entries showing authenticated low-privilege users issuing repeated queries to contact endpoints.
Detection Strategies
- Deploy WAF signatures that inspect the select query parameter on Groundhogg API routes for SQL metacharacters and reserved keywords.
- Enable MySQL general query logging temporarily on suspect hosts and correlate malformed queries with the Groundhogg plugin's caller stack.
- Audit WordPress user and role assignments to identify accounts granted the view_contacts capability outside of expected administrative use.
Monitoring Recommendations
- Forward WordPress and web server access logs to a centralized analytics platform and alert on Groundhogg API requests containing SQL syntax in parameters.
- Track authentication events for accounts holding Groundhogg custom roles and flag unusual API activity following login.
- Monitor outbound database traffic for large or unusual result sets originating from the WordPress application user.
How to Mitigate CVE-2026-14029
Immediate Actions Required
- Update the Groundhogg plugin to a version later than 4.5.8 once the vendor publishes a patched release.
- Review all Groundhogg custom roles and revoke the view_contacts capability from accounts that do not require it.
- Disable the plugin on production sites until a patched version is confirmed available if untrusted users can register or authenticate.
Patch Information
The vulnerability affects all versions through 4.5.8. Vendor changesets are tracked in the Groundhogg Changeset Overview. Administrators should apply the next released version and validate that select parameter handling now uses wpdb::prepare() or an allow-list of column identifiers.
Workarounds
- Restrict access to /wp-json/gh/v4/ endpoints at the web server or WAF layer to trusted IP addresses.
- Remove the view_contacts capability from all non-administrative roles until the patched plugin version is deployed.
- Enforce least-privilege on the WordPress database user by removing permissions not required by the plugin, limiting the blast radius of injection.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
