CVE-2026-13226: Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Sales Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler wpajaxgroundhogggetcontactstable has its capability check commented out and performs no nonce verification, meaning any authenticated user regardless of role can reach the vulnerable code path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Groundhogg (CRM, Newsletters, and Marketing Automation)to a version that resolves this vulnerability.Fixed in 4.5.4 - Compensating control
Restrict access to the vulnerable AJAX endpoint wp_ajax_groundhogg_get_contacts_table so only properly authorized roles (Sales Manager-level access and above, as stated) can reach the code path, since the capability check is commented out and there is no nonce verification.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13226?
The severity of CVE-2026-13226 is medium with a score of 6.5.
How do I fix CVE-2026-13226?
To fix CVE-2026-13226, update the Groundhogg plugin to version 4.5.5 or later.
What type of vulnerability is CVE-2026-13226?
CVE-2026-13226 is an authenticated SQL injection vulnerability.
What versions of Groundhogg are affected by CVE-2026-13226?
All versions of Groundhogg up to and including 4.5.4 are affected by CVE-2026-13226.
What impact does CVE-2026-13226 have on my WordPress site?
CVE-2026-13226 can potentially allow an attacker to execute arbitrary SQL queries through the 'after' parameter, leading to data exposure.