CVE-2026-13333

Name of the Vulnerable Software and Affected Versions Groundhogg versions prior to 4.5.6

Description The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with Sales Representative-level access or higher can append malicious SQL queries to existing ones to extract sensitive database information. This occurs because of insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. The issue can be triggered via the query[select] parameter. Furthermore, the sanitized Contact Query code path can be bypassed by providing an invalid filter type in the query[filters][0][0][type] parameter, which triggers a FilterException and forces the application to use the unsanitized Legacy Contact Query path.

Recommendations Update the plugin to a version newer than 4.5.5. Avoid using the query[select] parameter in the affected plugin until the update is applied.