CVE-2025-12750: Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection via the 'term' parameter in all versions up to, and including, 4.2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12750?
CVE-2025-12750 has a high severity rating due to its potential for SQL Injection attacks.
How do I fix CVE-2025-12750?
To fix CVE-2025-12750, update the Groundhogg plugin to version 4.2.6.2 or later.
What impact does CVE-2025-12750 have on my website?
CVE-2025-12750 can allow attackers to execute arbitrary SQL queries on your database, compromising data security.
Is my site at risk if I use an outdated version of Groundhogg?
Yes, if your site is running Groundhogg version 4.2.6.1 or earlier, it is vulnerable to CVE-2025-12750.
How can I verify if my version of Groundhogg is affected by CVE-2025-12750?
Check the version of the Groundhogg plugin in your WordPress admin dashboard, and update if it is version 4.2.6.1 or earlier.