Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Groundhogg — CRM, Newsletters, and Marketing Automation Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 31 vulnerability records associated with Groundhogg — CRM, Newsletters, and Marketing Automation, published between 2019 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

31Total records
0Critical
11High
20Medium
0Low
0Informational
31Patched records
0Currently marked unpatched
2019-04-08First disclosure
2026-07-08Latest disclosure
29 of 31CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201933 records
20231010 records
202422 records
202588 records
202688 records

Severity Breakdown

SeverityRecordsShare
High1135.5%
Medium2064.5%

Vulnerability-Type Breakdown

SQL Injection

9 records29%

First: 2019. Latest: 2026.

Cross-Site Scripting

7 records22.6%

First: 2019. Latest: 2025.

Missing Authorization

4 records12.9%

First: 2023. Latest: 2026.

CSRF

4 records12.9%

First: 2023. Latest: 2024.

Path Traversal

3 records9.7%

First: 2025. Latest: 2026.

Other

2 records6.5%

First: 2019. Latest: 2025.

Arbitrary File Upload

2 records6.5%

First: 2025. Latest: 2025.

Patch Status

Patched
31
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 4.5
  • 4.5.9
  • 4.5.6
  • 4.5.1
  • 4.5.5
  • 4.4.1
  • 4.2.7
  • 4.2.6.1
  • 4.2.2.1
  • 4.2.2
  • 4.1.2
  • 4.0
  • 3.7.3.6
  • 3.7.3.4
  • 3.4.3
  • 2.7.11.11
  • 2.7.11.1
  • 2.7.10
  • 2.7.9.4
  • 2.0.8
  • 2.0.9.11
  • 1.3.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-2.7.9.8Groundhogg <= 2.7.9.8 - Missing Authorization to Update LicenseMay 19, 20232.7.10Medium
*-2.7.8.9Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket CreationMay 19, 20232.7.10Medium
*-2.7.9.3Groundhogg <= 2.7.9.3 - Authenticated (Administrator)+ SQL InjectionMarch 20, 20232.7.9.4High
*-1.3.11.13Groundhogg <= 1.3.11.13 - SQL InjectionOctober 23, 20192.0.8High
*-2.0.8.1Groundhogg <= 2.0.8.1 - Reflected Cross-Site ScriptingSeptember 10, 20192.0.9.11Medium
[*, 1.3.5)WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg < 1.3.5 - Remote Code ExecutionApril 8, 20191.3.5High

Selected source records

Latest Records

HighCVE-2026-57389

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion

Published: July 8, 2026

Affected versions
*-4.4.1
Patched versions
4.5
Original Wordfence record
MediumCVE-2026-14029

Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter

Published: July 1, 2026

Affected versions
*-4.5.8
Patched versions
4.5.9
Original Wordfence record
MediumCVE-2026-13333

Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter

Published: June 26, 2026

Affected versions
*-4.5.5
Patched versions
4.5.6
Original Wordfence record
MediumCVE-2026-57667

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection

Published: June 26, 2026

Affected versions
*-4.5
Patched versions
4.5.1
Original Wordfence record
MediumCVE-2026-13331

Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter

Published: June 26, 2026

Affected versions
*-4.5.5
Patched versions
4.5.6
Original Wordfence record
MediumCVE-2026-13226

Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter

Published: June 25, 2026

Affected versions
*-4.5.4
Patched versions
4.5.5
Original Wordfence record
MediumCVE-2026-40793

Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization

Published: April 24, 2026

Affected versions
[*, 4.4.1)
Patched versions
4.4.1
Original Wordfence record
HighCVE-2026-40727

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion

Published: April 16, 2026

Affected versions
*-4.4
Patched versions
4.4.1
Original Wordfence record

Highest-Severity Records

HighCVE-2019-15647

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg < 1.3.5 - Remote Code Execution

Published: April 8, 2019

Affected versions
[*, 1.3.5)
Patched versions
1.3.5
Original Wordfence record
HighCVE-2025-48300

Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload

Published: July 4, 2025

Affected versions
*-4.2.1
Patched versions
4.2.2
Original Wordfence record
HighCVE-2025-0394

Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function

Published: January 13, 2025

Affected versions
*-3.7.3.5
Patched versions
3.7.3.6
Original Wordfence record
High

Groundhogg <= 1.3.11.13 - SQL Injection

Published: October 23, 2019

Affected versions
*-1.3.11.13
Patched versions
2.0.8
Original Wordfence record
HighCVE-2026-57389

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion

Published: July 8, 2026

Affected versions
*-4.4.1
Patched versions
4.5
Original Wordfence record
HighCVE-2026-40727

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion

Published: April 16, 2026

Affected versions
*-4.4
Patched versions
4.4.1
Original Wordfence record
HighCVE-2025-54053

Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection

Published: August 5, 2025

Affected versions
*-4.2.2
Patched versions
4.2.2.1
Original Wordfence record
HighCVE-2023-2736

Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation

Published: May 19, 2023

Affected versions
*-2.7.9.8
Patched versions
2.7.10
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory