Groundhogg <= 4.5.8 Authenticated SQL Injection Vulnerability (CVE-2026-14029)

Vulnerability Overview Vulnerability Name: Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter CVE ID: CVE-2026-14029 CVSS Score: 6.5 (Medium) Publication Date: July 1, 2026 Last Updated: July 2, 2026 Researcher: PRISM Impact Scope Software Type: Plugin Software Name: Groundhogg – CRM, Newsletters, and Marketing Automation Affected Versions: <= 4.5.8 Fixed Version: 4.5.9 Remediation Recommendation: Upgrade to version 4.5.9 or later patched versions Vulnerability Description The Groundhogg – CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to general SQL injection via the 'select' parameter in versions up to 4.5.8. This is due to inadequate preparation of user-supplied parameters, leading to the appending of additional SQL queries to existing SQL queries, which may result in the extraction of sensitive information from the database. Exploiting this vulnerability requires the attacker to hold a Groundhogg custom role, which is granted by default the capability of built-in Groundhogg roles, above the basic subscriber level. References plugins.trac.wordpress.org Additional Information Software Slug: groundhogg (view on wordpress.org) Patched: Yes Recent Related Vulnerabilities: - Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter - Groundhogg – CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection - Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter - Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter - Groundhogg – CRM, Newsletters, and Marketing Automation <= 4.4.1 - Missing Authorization - Groundhogg – CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales Representative+) Arbitrary File Deletion - Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection - Groundhogg <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting - Groundhogg <= 4.2.7 - Authenticated (Sales Representative+) PHP Object Injection - Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload Notes This vulnerability database is completely free for personal and commercial use, containing all vulnerability data consistent with the user interface. API documentation and Webhook documentation are available. For more information, visit Wordfence Intelligence. Contact Technical Support: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24-hour support, year-round, 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: Used under the licensing terms of MITRE and Defiant Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Email Documentation Links Documentation Learn More Get Wordfence Subscription Stay Updated: Subscribe to receive the latest vulnerability notifications Footer Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscription Sign Up: Subscribe to receive the latest vulnerability notifications Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligence Wordfence Footer © 2012-2026 Defiant Inc. All Rights Reserved Others Wordfence Intelligen

Goal Reached Thanks to every supporter — we hit 100%!

Groundhogg <= 4.5.8 Authenticated SQL Injection Vulnerability (CVE-2026-14029)

More from this source