Groundhogg CRM CVE-2026-13331

Exploitation requires an authenticated session with Groundhogg marketer-level access or higher on the target WordPress installation - this is a plugin-specific role distinct from standard WordPress roles. The attacker must be able to send HTTP requests to the affected search endpoints (REST API or plugin admin pages). No non-default WordPress configuration is required beyond having the Groundhogg plugin installed and active. Exploitation is limited by: (1) the mandatory marketer-level authentication barrier, ruling out unauthenticated external attackers; (2) impact is confined to data exfiltration - no write or denial-of-service capability is indicated by the CVSS vector (I:N/A:N); and (3) exploitation is scoped to the WordPress database accessible by the plugin's database user, which may or may not include tables beyond the WordPress schema depending on server configuration.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects a network-reachable, low-complexity flaw with a meaningful authentication barrier - marketer-level access - that degrades the immediate threat compared to unauthenticated SQLi. Real-world risk is meaningful for organizations using Groundhogg at scale: the confidentiality impact is rated High, meaning full database read access is plausible via UNION-based or error-based injection. No EPSS data was provided, and neither KEV status nor confirmed public POC exists, suggesting exploitation has not been observed in the wild or is not yet widespread. However, the presence of five distinct vulnerable code paths and coverage reported by Wordfence (a high-visibility source) means a POC is feasible to construct. The primary limiting factor is the PR:L requirement - an attacker must first obtain a marketer-level account, which in practice means either compromised credentials, a brute force attack, or insider threat. The integrity and availability ratings of None reflect that this vulnerability is read-only data exfiltration, not modification or denial-of-service.

An attacker who holds or has compromised a marketer-level account within a Groundhogg-enabled WordPress site submits a crafted HTTP request to any of the vulnerable search endpoints - for example, the base-object REST API - with a malicious SQL fragment appended to the 'search' parameter value. The unsanitized input is concatenated into a live SQL query, allowing the attacker to use UNION-based injection to retrieve arbitrary tables from the WordPress database, including wp_users password hashes, Groundhogg contact and campaign data, or any other sensitive information stored in the database. No public POC has been confirmed, but the vulnerability class and multiple exposed code paths make construction of a working exploit straightforward for an experienced attacker.