WordPress Groundhogg plugin <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter vulnerability

Authenticated Vendor+ SQL Injection via 'tagquery' Parameter vulnerability discovered by Jonathan Dersch - Jonathan Dersch - Bug Bounty in WordPress Plugin Groundhogg versions = 4.5.14...

CVE-2026-18387

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tagquery' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-18387

CVE-2026-18387 affects the Groundhogg WordPress plugin (all versions up to 4.5.14) vulnerable to generic SQL Injection via the tag_query parameter. Root cause: insufficient escaping and inadequate preparation in the existing SQL query. Exploitation requires triggering Legacy_Contact_Query (e.g., ...

CVE-2026-18387

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tagquery' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

EUVD-2026-58855

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tagquery' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-18387 Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tagquery' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...