CVE-2026-18387: 
WordPress Análise e mitigação de vulnerabilidades

CVE-2026-18387 is a SQL Injection vulnerability in the Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress, affecting all versions up to and including 4.5.14. The flaw allows authenticated attackers with vendor-level access or above to append additional SQL queries via the tag_query parameter, enabling extraction of sensitive data from the database. It was published on August 15, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Wordfence).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and stems from insufficient escaping of the user-supplied tag_query parameter combined with inadequate preparation of the existing SQL query. Exploitation requires the attacker to trigger the vulnerable Legacy_Contact_Query code path by submitting an unknown filter type (e.g., filters[0][0][type]=force_fallback), which causes a FilterException that redirects execution away from the modern query handler to the legacy, unprotected path. This makes the attack non-trivial but achievable by any authenticated user with vendor-level privileges or higher (Feedly).

Successful exploitation allows an authenticated attacker to extract sensitive information from the WordPress database, including contact records, CRM data, newsletter subscriber details, and potentially WordPress user credentials or configuration data. The impact is limited to confidentiality (no integrity or availability impact), but exposure of CRM and marketing data could have significant privacy and compliance consequences. Lateral movement within the application or broader infrastructure is possible if database credentials or other secrets are retrieved (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of publication. The NVD SSVC assessment indicates exploitation is currently "none" and the attack is not automatable, reflecting the requirement for authenticated vendor-level access and a specific trigger condition. The EPSS score is approximately 0.39%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Groundhogg plugin at version 4.5.14 or earlier. This can be done by checking plugin metadata exposed in the site's source or via tools like WPScan.
2. Obtain vendor-level credentials: Acquire or compromise an account with vendor-level access or higher on the target WordPress site (e.g., through phishing, credential stuffing, or insider access).
3. Trigger the Legacy_Contact_Query code path: Submit a crafted request to the Groundhogg contact query endpoint with an unknown filter type, such as filters[0][0][type]=force_fallback, to cause a FilterException and redirect execution to the legacy query handler.
4. Inject malicious SQL via tag_query: Append a malicious SQL payload to the tag_query parameter (e.g., tag_query=1 UNION SELECT user_login,user_pass,3 FROM wp_users--) to extract sensitive data from the database.
5. Exfiltrate data: Collect the returned query results, which may include contact records, CRM data, subscriber lists, or WordPress user credentials (Feedly).

• Logs: WordPress or web server access logs showing requests to Groundhogg contact query endpoints with filters[0][0][type]=force_fallback or other unknown filter type values in the request body or query string.
• Logs: Database query logs (if enabled) showing unexpected UNION SELECT, OR 1=1, or other SQL injection patterns originating from Groundhogg plugin queries.
• Network: Unusual outbound data transfers from the web server following authenticated Groundhogg API requests, potentially indicating data exfiltration.
• Application: PHP error logs showing repeated FilterException events triggered by the Groundhogg plugin, which may indicate probing of the legacy code path (Feedly).

Users should update the Groundhogg — CRM, Newsletters, and Marketing Automation plugin to a version beyond 4.5.14 as soon as a patched release is available from the vendor (trainingbusinesspros). In the interim, restrict vendor-level and above account access to trusted users only, and consider using a WordPress security plugin (such as Wordfence) with virtual patching capabilities to block exploitation attempts. Monitor plugin update channels and the WordPress plugin repository for a patched release (Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for August 10–16, 2026, highlighting it as part of a broader set of plugin security issues tracked that week (Wordfence). No significant additional vendor statements, researcher commentary, or notable social media discussion has been identified beyond standard vulnerability database aggregation.