CVE-2026-18387: 
WordPress vulnerability analysis and mitigation

CVE-2026-18387 is a SQL Injection vulnerability in the Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress, affecting all versions up to and including 4.5.14. The flaw allows authenticated attackers with vendor-level access or above to append malicious SQL queries via the tag_query parameter, enabling extraction of sensitive data from the database. It was published on August 15, 2026, and carries a CVSS v3.1 base score of 6.5 (High) (Feedly, VulDB).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), stemming from insufficient escaping of the user-supplied tag_query parameter and inadequate preparation of the underlying SQL query. Exploitation requires the attacker to trigger the vulnerable Legacy_Contact_Query code path by submitting an unknown filter type (e.g., filters[0][0][type]=force_fallback), which causes a FilterException that redirects execution away from the modern query handler to the legacy, unprotected path. Once on this code path, the attacker can append arbitrary SQL to the existing query over the network without user interaction, requiring only low-privilege (vendor-level) authentication (Feedly).

Successful exploitation allows an authenticated attacker to read sensitive information from the WordPress database, including contact records, CRM data, newsletter subscriber details, and potentially WordPress user credentials or configuration data. The impact is limited to confidentiality (no integrity or availability impact is reported), but exposure of CRM and marketing data could have significant privacy and compliance consequences. Lateral movement within the application or to other systems may be possible if database credentials or other secrets are extracted (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the publication date. The vulnerability requires authenticated access at vendor level or above, which limits the attacker pool but does not eliminate risk in multi-tenant or compromised environments. The CVE status is listed as "Received" and no EPSS score or CISA KEV catalog entry has been identified at this time (Feedly, VulDB).

1. Reconnaissance: Identify WordPress sites running the Groundhogg plugin at version 4.5.14 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain vendor-level credentials: Acquire an account with vendor-level access or above on the target WordPress instance (e.g., through phishing, credential stuffing, or insider access).
3. Trigger the legacy code path: Submit a crafted request to the Groundhogg contact query endpoint with an unknown filter type, such as filters[0][0][type]=force_fallback, to cause a FilterException and redirect execution to the vulnerable Legacy_Contact_Query handler.
4. Inject malicious SQL via tag_query: Append a SQL injection payload to the tag_query parameter (e.g., tag_query=1 UNION SELECT user_login,user_pass,3 FROM wp_users--) to extract data from the database.
5. Exfiltrate data: Collect the query results returned in the application response, which may include contact records, user credentials, or other sensitive database contents (Feedly).

• Network: Unusual HTTP requests to Groundhogg contact query endpoints containing filters[0][0][type]=force_fallback or other unknown filter type values in POST/GET parameters.
• Logs: WordPress or web server access logs showing repeated requests to Groundhogg API endpoints with tag_query parameters containing SQL keywords (e.g., UNION, SELECT, --, OR 1=1).
• Application: Unexpected or large volumes of contact/CRM data returned in API responses; error logs referencing FilterException or Legacy_Contact_Query class invocations.
• Database: Unusual or high-frequency SELECT queries against WordPress tables (e.g., wp_users, wp_gh_contacts) originating from the web application process (Feedly).

Users should update the Groundhogg plugin to a version beyond 4.5.14 as soon as a patched release is made available by the vendor (trainingbusinesspros). In the interim, restrict vendor-level account access to trusted users only and monitor for suspicious query activity. Web application firewalls (WAFs) with SQL injection rulesets can provide an additional layer of defense while awaiting a patch (Feedly, VulDB).