CVE-2026-104408

Summary

This vulnerability allows authenticated attackers with limited privileges to perform blind SQL injection attacks against the Groundhogg plugin, potentially leading to data exposure and unauthorized access to sensitive information.

Exploitability

Exploitation requires an authenticated user with minimal privileges, making it moderately difficult but achievable through social engineering or compromised credentials.

Blast radius

If exploited, this vulnerability could allow attackers to extract sensitive user data, including personal information and potentially administrative credentials from the affected WordPress site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Groundhogg version 4.8.4 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.