Groundhogg <= 4.5.14 Authenticated SQL Injection via 'tag_query' (CVE-2026-16387)

Vulnerability Overview Vulnerability Name: Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter CVE ID: CVE-2026-16387 CVSS Score: 6.5 (Medium) Publication Date: August 14, 2026 Last Updated: August 15, 2026 Researcher: Jonathan Dersch - Jonathan Dersch - Bug Bounty Affected Versions Affected Versions: Groundhogg <= 4.5.14 Software Type: Plugin Software Name: Groundhogg – CRM, Newsletters, and Marketing Automation Software Link: wordpress.org Remediation Fixed Version: 4.5.15 or later Vulnerability Description The Groundhogg – CRM, Newsletters, and Marketing Automation plugin for WordPress contains an SQL injection vulnerability via the parameter. This vulnerability allows authenticated attackers (requiring Vendor+ level privileges) to execute arbitrary SQL queries by crafting malicious requests, potentially leading to the extraction of sensitive information. References plugins.trac.wordpress.org Additional Information Sharing Options: Can be shared via Facebook, Twitter, LinkedIn, and Email. Disclaimer: The bottom of the page contains copyright and licensing information, as well as details about Wordfence Intelligence. Recent Vulnerability List Other recent vulnerabilities in Groundhogg – CRM, Newsletters, and Marketing Automation include: - CVE-2026-11454: Insecure Direct Object Reference - CVE-2026-57389: Authenticated (Sales Representative+) Arbitrary File Deletion - CVE-2026-14029: Authenticated (Custom+) SQL Injection via 'select' Parameter - CVE-2026-13333: Authenticated (Sales Rep+) SQL Injection via 'queryselect' Parameter - CVE-2026-57667: Authenticated (Sales Representative+) SQL Injection - CVE-2026-13331: Authenticated (Marketer+) SQL Injection via 'search' Parameter - CVE-2026-13226: Authenticated (Custom+) SQL Injection via 'after' Parameter - CVE-2026-40793: Missing Authorization - CVE-2026-40727: Authenticated (Sales Representative+) Arbitrary File Deletion - CVE-2025-12750: Authenticated (Admin+) SQL Injection Summary The Groundhogg plugin contains an SQL injection vulnerability in versions 4.5.14 and below. It is recommended to upgrade to version 4.5.15 or later to resolve this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Groundhogg <= 4.5.14 Authenticated SQL Injection via 'tag_query' (CVE-2026-16387)