CVE-2026-13333 Overview
CVE-2026-13333 is a SQL injection vulnerability in the Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress. The flaw affects all versions up to and including 4.5.5. It stems from insufficient escaping of the query[select] parameter and lack of prepared statements in the underlying SQL query [CWE-89]. Authenticated attackers with Sales Representative-level access or higher can append additional SQL statements to existing queries to extract sensitive database contents. The sanitized Contact_Query code path can be bypassed by supplying an invalid filter type, which triggers a FilterException and falls through to the unsanitized Legacy_Contact_Query path.
Critical Impact
Authenticated attackers with Sales Representative privileges can extract sensitive information from the WordPress database, including user credentials, session tokens, and CRM contact data.
Affected Products
- Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress
- All versions up to and including 4.5.5
- WordPress sites where authenticated users hold Sales Representative-level roles or higher
Discovery Timeline
- 2026-06-27 - CVE-2026-13333 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-13333
Vulnerability Analysis
The Groundhogg plugin exposes an API endpoint that accepts a query[select] parameter used to construct SQL statements against the WordPress database. The parameter is concatenated into the SQL string without sufficient escaping or parameter binding, allowing attackers to inject arbitrary SQL fragments. Reference implementations for the vulnerable path are visible in the plugin's contacts-api.php and legacy-contact-query.php source files.
The plugin includes a sanitized query path called Contact_Query, which is intended to safely process filter input. However, when the code encounters an unknown filter type, it throws a FilterException that is caught by the calling code. Execution then falls through to the legacy Legacy_Contact_Query handler, which does not sanitize the query[select] parameter. This fallback behavior transforms an input validation error into a full SQL injection primitive.
Root Cause
The root cause is twofold. First, the Legacy_Contact_Query path in legacy-contact-query.php does not use prepared statements or escape user input passed via query[select]. Second, the error handling logic converts filter validation failures into a control-flow bypass by falling back to the vulnerable legacy path instead of rejecting the request.
Attack Vector
An authenticated attacker submits a request to the contacts API endpoint with a crafted query[select] value and an invalid filter type such as query[filters][0][0][type]=invalid_filter_nonexistent. The invalid filter triggers the FilterException, execution falls through to Legacy_Contact_Query, and the injected SQL is executed against the database. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-13333
Indicators of Compromise
- HTTP requests to Groundhogg contacts API endpoints containing query[select] parameters with SQL keywords such as UNION, SELECT, FROM, or comment sequences like -- and /*.
- Requests containing query[filters][0][0][type]=invalid_filter_nonexistent or similar unknown filter type values used to trigger the legacy code path.
- Anomalous outbound response sizes from the WordPress site when contacts API endpoints are called by low-privilege accounts.
Detection Strategies
- Inspect WordPress access logs and web application firewall telemetry for the query[select] parameter carrying SQL metacharacters.
- Correlate Sales Representative-level session activity with contacts API calls that include filter type parameters not defined by the plugin.
- Monitor MySQL slow query and general query logs for unexpected queries originating from the Groundhogg plugin process context.
Monitoring Recommendations
- Enable and centralize WordPress and web server access logs to a SIEM for rule-based alerting on SQL injection patterns targeting /wp-json/gh/v3/ routes.
- Track authenticated user roles performing contacts API queries and alert when Sales Representative accounts issue high-volume or unusually structured queries.
- Baseline normal Groundhogg API usage and alert on deviations in parameter shape, particularly nested query[filters] structures with invalid types.
How to Mitigate CVE-2026-13333
Immediate Actions Required
- Update the Groundhogg plugin to a version later than 4.5.5 that includes the fix referenced in the WordPress Groundhogg Changeset.
- Audit user accounts with Sales Representative-level access or higher and remove unnecessary privileges.
- Rotate WordPress administrator credentials, API keys, and any secrets stored in the database if exploitation is suspected.
Patch Information
The vendor addressed the vulnerability in a subsequent release following version 4.5.5. The upstream fix is tracked in the plugin's changeset repository. Site operators should apply the plugin update through the WordPress plugin manager or via WP-CLI as soon as possible.
Workarounds
- Restrict access to the Groundhogg contacts API endpoints at the web server or WAF layer to trusted IP ranges until the plugin is updated.
- Deploy WAF signatures that block requests containing SQL metacharacters in the query[select] parameter of Groundhogg API routes.
- Temporarily downgrade or remove Sales Representative-level user accounts that are not actively required for business operations.
# Update Groundhogg via WP-CLI to the latest patched version
wp plugin update groundhogg
wp plugin get groundhogg --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
