CVE-2026-13333: Groundhogg SQL Injection Vulnerability – CRM Data at Risk

Technical summary

CVE-2026-13333 is a SQL injection vulnerability (CWE-89) in Groundhogg through version 4.5.5. The 'query[select]' parameter and associated filter handling fail to properly escape user-supplied input before incorporating it into SQL queries. The plugin implements a sanitized Contact_Query path, but this can be circumvented by supplying an invalid filter type (e.g., query[filters][0][0][type]=invalid_filter_nonexistent). When an invalid filter triggers a FilterException, execution falls through to a Legacy_Contact_Query code path that lacks adequate SQL preparation. An authenticated attacker with Sales Representative privileges or above can craft malicious queries to append arbitrary SQL, leading to unauthorized data disclosure from the database.

Business impact

Organizations relying on Groundhogg for customer relationship management face unauthorized access to sensitive contact and business data. Sales teams, which typically have Sales Representative access, could inadvertently enable attackers to extract customer records, email addresses, interaction histories, and potentially linked financial or personal information. This exposes the organization to compliance violations (GDPR, CCPA, etc.), reputational damage, and potential customer notification obligations. The vulnerability is particularly concerning for businesses that store customer or prospect data in Groundhogg and need to demonstrate data protection controls to regulators or customers.

Affected systems

WordPress installations running the Groundhogg — CRM, Newsletters, and Marketing Automation plugin in version 4.5.5 or earlier are affected. The vulnerability requires an authenticated user account with Sales Representative-level access or higher. Organizations should inventory all WordPress sites using Groundhogg and verify which versions are deployed.

Exploitability

This vulnerability requires authentication and a minimum privilege level (Sales Representative or above), which limits the attack surface compared to unauthenticated exploits. However, in many organizations, Sales Representatives have broad access to CRM systems, and the exploitation method is straightforward once an attacker has valid credentials—no complex setup, chaining, or user interaction is needed. The bypass mechanism (invalid filter triggering an exception) is simple to discover through fuzzing or code review. The CVSS score of 6.5 (Medium) reflects the confidentiality impact offset by authentication and privilege requirements.

Remediation

Update the Groundhogg plugin to a patched version released after 4.5.5 that properly escapes the 'query[select]' parameter and sanitizes all filter-based query construction, regardless of filter validity. Verify that the patch removes the fallthrough to unsanitized legacy code paths. Additionally, review and tighten access controls for Sales Representative accounts—ensure only users who genuinely require CRM access retain these privileges, reducing the population of potential attackers.

Patch guidance

Check the Groundhogg plugin repository and vendor advisory for the patched version address released in response to CVE-2026-13333. Update the plugin through the WordPress admin interface once a patch is available. Before updating in production, test on a staging environment to ensure compatibility with your WordPress version, PHP version, and any custom integrations. After patching, verify that the plugin's database connection queries properly use prepared statements and escape user input throughout the contact query and filter handling logic.

Detection guidance

Monitor WordPress access logs and database query logs for unusual SQL patterns originating from authenticated users with Sales Representative privileges. Look for SQL keywords (UNION, SELECT, OR, AND, etc.) appearing in request parameters, particularly in 'query[select]' and 'query[filters]' fields. Database query logs should be reviewed for unexpected queries appended to contact or CRM queries, especially those accessing sensitive tables outside the normal scope. Plugin audit logs (if available) should be checked for filter validation exceptions (FilterException) combined with database queries. Consider using a Web Application Firewall (WAF) to detect and block suspicious SQL patterns before they reach WordPress.

Why prioritize this

Although the CVSS score is Medium, prioritize this vulnerability for organizations where Groundhogg is actively used for sensitive customer data. The authentication requirement and privilege threshold lower the risk compared to unauthenticated exploits, but the ease of exploitation and high confidentiality impact (C:H) warrant prompt patching. Organizations with strict data protection obligations, large customer databases, or Sales teams with frequent external collaboration should treat this as higher priority. If Groundhogg is used only for low-sensitivity internal operations, it may be queued behind critical unpatched vulnerabilities, but should still be addressed within a standard patch cycle.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity rating: Network-accessible, low attack complexity, but requiring authentication and Sales Representative privileges. The vulnerability has high confidentiality impact (C:H) due to unrestricted data extraction, but no impact on integrity or availability (I:N, A:N). The privilege requirement (PR:L) and authentication boundary prevent widespread exploitation. Organizations' actual risk depends on how widely Sales Representative access is granted and how sensitive the data stored in Groundhogg is; security context matters more than the base score alone.

Frequently asked questions