CVE-2023-1425: Groundhogg Contacts < 2.7.9.4 - Admin+ SQLi

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-04-10 · updated 2026-06-17

Description

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins

Affected products

trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation: before 2.7.9.4 — fixed in 2.7.9.4

How to fix

Upgrade to a fixed version: trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation 2.7.9.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/578f4179-e7be-4963-9379-5e694911b451
https://wpscan.com/vulnerability/578f4179-e7be-4963-9379-5e694911b451

Get alerted when CVE-2023-1425 or the next vulnerability affects your stack