The Groundhogg WordPress plugin is affected by an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. Specifically, the 'after' parameter is not properly escaped or prepared in SQL queries, enabling authenticated attackers with Sales Manager-level privileges or higher to inject additional SQL commands. The AJAX handler wp_ajax_groundhogg_get_contacts_table has its capability check commented out and lacks nonce verification, which broadens access to the vulnerable code to any authenticated user regardless of role. This vulnerability allows unauthorized extraction of sensitive information from the database. No official patch or remediation guidance has been provided as of the published date.

An attacker with at least Sales Manager-level access can exploit the SQL Injection vulnerability to extract sensitive information from the database. Due to the missing capability checks and nonce verification in the AJAX handler, any authenticated user can reach the vulnerable code path, potentially increasing the attack surface. The vulnerability does not impact integrity or availability but compromises confidentiality of data stored in the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted personnel only and monitor for suspicious activity. Review and harden WordPress user role permissions to limit access to Sales Manager-level or higher accounts. Consider disabling or restricting access to the vulnerable AJAX handler if possible.