CVE-2026-13331: Groundhogg WordPress Plugin SQLi Flaw

CVE-2026-13331 Overview

CVE-2026-13331 is a SQL Injection vulnerability [CWE-89] in the Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress. The flaw affects all versions up to and including 4.5.5. The plugin fails to properly escape the user-supplied search parameter and does not sufficiently prepare the underlying SQL query. Authenticated attackers holding marketer-level access or higher can append additional SQL statements to existing queries. This enables extraction of sensitive information from the WordPress database.

Critical Impact
Authenticated attackers with marketer-level privileges can exfiltrate arbitrary database contents, including credentials, contact records, and session data managed by the CRM plugin.

Affected Products

Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress
All versions up to and including 4.5.5
WordPress sites running Groundhogg with users assigned marketer-level roles or higher

Discovery Timeline

2026-06-27 - CVE-2026-13331 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13331

Vulnerability Analysis

The vulnerability resides in Groundhogg's database access layer, specifically in code paths that build queries from a search request parameter. The affected code is reachable through the plugin's v4 REST API base object handler at api/v4/base-object-api.php and the underlying db/db.php and db/steps.php query builders. The search value flows into SQL statements without adequate escaping or use of prepared statements. Because Groundhogg exposes CRM search functionality to marketer-level and higher roles, any user granted those capabilities can inject arbitrary SQL fragments. Successful exploitation leads to disclosure of table contents, including WordPress wp_users records and Groundhogg contact data.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin concatenates the search parameter into query strings rather than binding it as a parameter through $wpdb->prepare(). Insufficient escaping compounds the issue, allowing attackers to break out of the intended string context and append clauses such as UNION SELECT.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session with marketer-level capabilities or above. The attacker sends a crafted request to a Groundhogg endpoint that consumes the search parameter. Injected SQL is executed by the database server with the privileges of the WordPress database user. Impact is limited to confidentiality: the attacker reads data but the CVSS vector indicates no integrity or availability impact.

Synthetic exploit code is not published. See the Wordfence Vulnerability Details and the vulnerable source lines in the WordPress Groundhogg API Reference, db.php line 330, and steps.php line 231 for technical details.

Detection Methods for CVE-2026-13331

Indicators of Compromise

Requests to Groundhogg REST endpoints under /wp-json/gh/v4/ containing SQL syntax such as UNION, SELECT, SLEEP(, or comment sequences (--, #, /*) in the search query parameter.
Unexpected outbound queries from the WordPress database process referencing wp_users, wp_usermeta, or Groundhogg contact tables outside normal plugin workflows.
New or recently promoted WordPress accounts holding the marketer role prior to suspicious API traffic.

Detection Strategies

Enable WordPress debug logging and MySQL general query logging on staging systems to identify malformed queries originating from the plugin.
Deploy a web application firewall rule that inspects the search parameter on Groundhogg endpoints for SQL metacharacters and known injection payloads.
Correlate authenticated session activity with database query anomalies to flag marketer accounts performing bulk data retrieval.

Monitoring Recommendations

Alert on HTTP 200 responses to Groundhogg API calls that return unusually large payloads relative to baseline search traffic.
Monitor WordPress role changes and audit which accounts hold marketer-level or higher capabilities.
Track failed and successful logins for marketer accounts and correlate with subsequent API requests to Groundhogg endpoints.

How to Mitigate CVE-2026-13331

Immediate Actions Required

Update the Groundhogg plugin to a version later than 4.5.5 that includes the fix referenced in the WordPress Groundhogg Changeset.
Audit all WordPress user accounts and remove marketer-level or higher privileges from users who do not require them.
Rotate WordPress administrator credentials and database secrets if compromise is suspected.

Patch Information

The vendor released a fix tracked in changeset 3586389 on the WordPress plugin repository. Site administrators should upgrade Groundhogg to the first release published after version 4.5.5. Review the Wordfence Vulnerability Details advisory to confirm the fixed version before deployment.

Workarounds

Restrict access to the WordPress REST API from untrusted networks using an application-layer proxy or WAF rule set.
Temporarily downgrade users assigned marketer capabilities to lower-privileged roles until patching is completed.
Deploy WAF signatures that block SQL metacharacters in the search parameter on Groundhogg endpoints.

bash

# Configuration example: ModSecurity rule blocking SQL keywords in the Groundhogg 'search' parameter
SecRule REQUEST_URI "@contains /wp-json/gh/v4/" \
    "chain,phase:2,deny,status:403,id:1026133310,msg:'CVE-2026-13331 Groundhogg SQLi attempt'"
    SecRule ARGS:search "@rx (?i)(union[\s\+]+select|sleep\s*\(|--|/\*|;)" "t:none,t:urlDecodeUni"