CVE-2026-18387 is an SQL Injection vulnerability in the Groundhogg WordPress plugin affecting all versions up to and including 4.5.14. The flaw arises from insufficient escaping of the 'tag_query' parameter and inadequate preparation of SQL queries in the Legacy_Contact_Query code path. Exploitation requires an authenticated attacker with vendor-level privileges to submit a crafted filter type that triggers a FilterException, diverting execution to the vulnerable legacy query handler. This allows the attacker to append additional SQL queries to extract sensitive data from the database. The CVSS v3.1 base score is 6.5, indicating medium severity. No patch or official remediation is currently documented.

An authenticated attacker with vendor-level access or higher can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL commands. The vulnerability does not affect confidentiality, integrity, or availability beyond unauthorized data disclosure. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict vendor-level access to trusted users only and monitor for unusual activity involving the 'tag_query' parameter. Avoid triggering the legacy query path by not submitting unknown filter types if possible.