CVE-2026-13331

Name of the Vulnerable Software and Affected Versions Groundhogg versions prior to 4.5.6

Description The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a generic SQL Injection flaw. This occurs because the software fails to properly escape user-supplied input and lacks sufficient preparation of the SQL query. Authenticated attackers with marketer-level access or higher can exploit this by appending malicious SQL queries via the search parameter to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 4.5.5. Avoid using the search parameter if the plugin cannot be updated immediately.