CVE-2026-13226

Name of the Vulnerable Software and Affected Versions Groundhogg versions prior to 4.5.5

Description The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a SQL Injection flaw. This occurs because the plugin fails to properly escape user-supplied input and lacks sufficient preparation of the SQL query. Authenticated attackers with Sales Manager-level access or higher can append malicious SQL queries to extract sensitive database information. Additionally, the AJAX handler wp ajax groundhogg get contacts table has its capability check disabled and lacks nonce verification, allowing any authenticated user, regardless of their assigned role, to access the vulnerable code path via the after parameter.

Recommendations Update the plugin to a version newer than 4.5.4. Restrict access to the wp ajax groundhogg get contacts table handler to minimize the risk of exploitation.