CVE-2026-57667: Groundhogg SQLi Vulnerability

CVE-2026-57667 Overview

CVE-2026-57667 is a SQL injection vulnerability affecting the Groundhogg WordPress plugin in versions up to and including 4.5. The flaw allows an authenticated user with the Sales Representative role to inject arbitrary SQL statements through unsanitized input handled by the plugin. Successful exploitation lets attackers extract sensitive database contents, including CRM records and marketing data managed by Groundhogg. The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Public advisories are available via Patchstack.

Critical Impact
Authenticated Sales Representative users can execute arbitrary SQL queries against the WordPress database, exposing confidential CRM data and contact records.

Affected Products

Groundhogg WordPress plugin versions <= 4.5
WordPress sites running Groundhogg with the Sales Representative role enabled
Any deployment allowing untrusted users access to the Sales Representative role

Discovery Timeline

2026-06-26 - CVE-2026-57667 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-57667

Vulnerability Analysis

The vulnerability resides in Groundhogg's handling of user-supplied input within functionality accessible to the Sales Representative role. The plugin fails to properly neutralize special SQL characters before constructing database queries. An authenticated attacker with the Sales Representative role can inject crafted SQL fragments into vulnerable parameters. The injected SQL is executed with the privileges of the WordPress database user, which typically has full read and write access to the site database.

The scope change reflected in the vulnerability metrics indicates that exploitation impacts resources beyond the vulnerable component itself. This means an attacker can pivot from the plugin context to broader WordPress database contents, including user tables, options, and other plugins' data.

EPSS data reports a probability of 0.211% at percentile 11.379 as of 2026-07-03, indicating limited observed exploitation activity to date.

Root Cause

The root cause is insufficient input sanitization and lack of parameterized queries in code paths reachable by the Sales Representative role. Groundhogg concatenates untrusted input directly into SQL statements rather than using prepared statements with bound parameters. This design flaw categorizes the issue under [CWE-89].

Attack Vector

Exploitation requires network access to the WordPress site and valid authentication as a user holding the Sales Representative role. No user interaction is required beyond the attacker's own actions. An attacker submits crafted input through a plugin endpoint accessible to Sales Representative users, causing the backend to execute attacker-controlled SQL against the WordPress database.

The vulnerability is described in prose only; refer to the Patchstack advisory for technical specifics.

Detection Methods for CVE-2026-57667

Indicators of Compromise

Unexpected SQL syntax, UNION SELECT, SLEEP(, or comment sequences (--, /*) appearing in HTTP request parameters to Groundhogg endpoints
Web server access logs showing requests from Sales Representative accounts targeting Groundhogg admin-ajax or REST endpoints with encoded payloads
Anomalous database query patterns or long-running queries originating from the WordPress process

Detection Strategies

Review WordPress and web server logs for requests containing SQL metacharacters submitted by users assigned the Sales Representative role
Enable WordPress database query logging temporarily and correlate suspicious queries with authenticated sessions
Deploy a web application firewall with signatures for SQL injection targeting WordPress plugin endpoints

Monitoring Recommendations

Audit all accounts assigned the Sales Representative role and remove any that are no longer required
Monitor for unauthorized changes to WordPress user tables, options, and Groundhogg contact records
Alert on outbound data transfers from the WordPress host that exceed baseline volumes, which may indicate database exfiltration

How to Mitigate CVE-2026-57667

Immediate Actions Required

Upgrade Groundhogg to a version later than 4.5 that contains the vendor's fix
Restrict assignment of the Sales Representative role to trusted users only
Review recent activity logs for the Sales Representative accounts and rotate credentials

Patch Information

The vendor has released a patched version of Groundhogg addressing the SQL injection. Site administrators should update the plugin through the WordPress admin dashboard or by downloading the latest release. See the Patchstack advisory for fixed version details.

Workarounds

Temporarily suspend or remove the Sales Representative role until the plugin can be updated
Deploy web application firewall rules that block SQL injection patterns against /wp-admin/admin-ajax.php and Groundhogg REST endpoints
Enforce database least privilege by ensuring the WordPress database user cannot access unrelated databases on the same server

bash

# Configuration example: disable the Groundhogg plugin until patched
wp plugin deactivate groundhogg

# Remove the Sales Representative role from a user
wp user remove-role <user_login> sales_representative