CVE-2026-13226: Groundhogg WordPress Plugin SQLi Flaw

CVE-2026-13226 Overview

CVE-2026-13226 is a SQL Injection vulnerability [CWE-89] in the Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress. The flaw affects all versions up to and including 4.5.4. The plugin fails to escape the user-supplied after parameter and does not properly prepare the SQL query. Attackers can append additional SQL statements into existing queries to extract sensitive database contents. Although the intended access boundary is Sales Manager and above, the AJAX handler wp_ajax_groundhogg_get_contacts_table has its capability check commented out and performs no nonce verification. Any authenticated user can reach the vulnerable code path.

Critical Impact
Authenticated attackers can execute arbitrary SQL against the WordPress database, exposing user credentials, session data, and CRM contact records.

Affected Products

Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress
All versions up to and including 4.5.4
WordPress sites running the vulnerable plugin with authenticated user registration enabled

Discovery Timeline

2026-06-26 - CVE-2026-13226 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-13226

Vulnerability Analysis

The vulnerability resides in the contact query handling of the Groundhogg plugin. The after parameter flows from the AJAX request into SQL query construction without proper escaping or parameterization. Because the SQL statement is not prepared using placeholders, attacker-supplied SQL fragments are concatenated directly into the executed query. This produces a classic generic SQL injection pattern where UNION-based or stacked payloads can retrieve arbitrary data.

The defect is compounded by broken access control. The AJAX handler wp_ajax_groundhogg_get_contacts_table in admin/contacts/contacts-page.php has its capability check commented out, and no nonce is verified. Any authenticated user, including low-privilege Subscriber accounts, can trigger the vulnerable code path.

Root Cause

Two issues combine to create the vulnerability. First, the query builder in includes/contact-query.php and includes/legacy-contact-query.php interpolates the after parameter directly into SQL without using $wpdb->prepare(). Second, the AJAX endpoint that reaches this query builder omits capability verification and nonce validation. The result is an authenticated SQL injection reachable by any WordPress user role.

Attack Vector

An attacker with any authenticated WordPress session on a vulnerable site sends a crafted POST request to admin-ajax.php invoking the groundhogg_get_contacts_table action. The malicious payload is placed in the after parameter, where it is concatenated into a SELECT query against the Groundhogg contacts table. Time-based, UNION-based, or error-based extraction techniques are all applicable.

A full technical description is available in the Wordfence Vulnerability Report and the plugin source references such as the Groundhogg Contact Query and Legacy Contact Query.

Detection Methods for CVE-2026-13226

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=groundhogg_get_contacts_table originating from low-privilege user sessions.
after parameter values containing SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or comment tokens like -- and #.
Unusual response latency on admin-ajax.php calls consistent with time-based blind injection.
Database error strings referencing the wp_gh_contacts table appearing in web server or PHP error logs.

Detection Strategies

Inspect WordPress access logs for repeated groundhogg_get_contacts_table AJAX calls from a single authenticated session.
Deploy a Web Application Firewall rule that inspects the after parameter for SQL metacharacters when the target action is groundhogg_get_contacts_table.
Correlate authentication events with AJAX traffic to flag low-privilege accounts touching CRM admin endpoints.

Monitoring Recommendations

Enable MySQL query logging or slow query logging to identify anomalous SELECT statements against Groundhogg tables.
Alert on outbound data volumes from WordPress hosts that spike shortly after admin-ajax.php activity.
Track new or dormant WordPress accounts that suddenly begin interacting with plugin AJAX endpoints.

How to Mitigate CVE-2026-13226

Immediate Actions Required

Update the Groundhogg plugin to a version later than 4.5.4 that includes the fix referenced in the WordPress plugin changeset 3585561.
Audit WordPress user accounts and remove unused or unrecognized authenticated users.
Rotate WordPress administrator credentials and any API keys stored in the database if exploitation is suspected.
Review CRM contact data for signs of unauthorized export.

Patch Information

The vendor released a corrected version that adds proper capability checks to the wp_ajax_groundhogg_get_contacts_table handler and applies $wpdb->prepare() to the after parameter. Site owners should upgrade via the WordPress plugin manager. The relevant fix is documented in the Groundhogg plugin changeset.

Workarounds

Disable the Groundhogg plugin until patching is possible if authenticated user registration is enabled on the site.
Restrict access to /wp-admin/admin-ajax.php at the WAF layer, denying the groundhogg_get_contacts_table action for non-administrator roles.
Temporarily disable open user registration in WordPress settings to reduce the pool of authenticated attackers.

bash

# Example WAF rule (ModSecurity) to block SQL metacharacters in the vulnerable parameter
SecRule ARGS:action "@streq groundhogg_get_contacts_table" \
    "chain,id:1026132226,phase:2,deny,status:403,msg:'Block CVE-2026-13226 SQLi attempt'"
    SecRule ARGS:after "@rx (?i)(union|select|sleep\(|benchmark\(|--|#|/\*)" "t:none"