The Groundhogg WordPress plugin is vulnerable to SQL Injection via the 'term' parameter due to improper neutralization of special elements in SQL commands (CWE-89). This vulnerability allows authenticated administrators to inject additional SQL queries into existing ones because of insufficient escaping and lack of prepared statements. The CVSS 3.1 base score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official fix information is provided in the available data.

An attacker with Administrator-level privileges can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. The confidentiality of the database is at risk, but integrity and availability are not impacted. Since exploitation requires high privileges, the risk is limited to users who already have significant access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to SQL queries involving the 'term' parameter. Avoid using vulnerable versions of the plugin if possible.