Groundhogg CVE-2026-13333

Exploitation requires three specific conditions: (1) the Groundhogg plugin installed and active on a WordPress instance, (2) an authenticated session with at minimum Sales Representative-level access within the Groundhogg plugin (confirmed by CVSS PR:L - unauthenticated exploitation is not possible), and (3) the ability to send crafted HTTP requests to the Groundhogg v3 REST API contacts endpoint. The bypass itself requires supplying an invalid value for query[filters][0][0][type] (for example, invalid_filter_nonexistent) to force the FilterException and reach the unsanitized Legacy_Contact_Query code path - this is a required trigger, not an optional step. Exploitation is strictly limited to confidentiality impact (read-only database extraction); no write or denial-of-service capability is available through this vector (CVSS I:N/A:N). The practical risk is further bounded by the requirement for a valid Groundhogg role, meaning only sites with externally-facing or lower-trust internal Sales Representative accounts face meaningful opportunistic exposure.

The CVSS 6.5 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately represents the threat profile. Network accessibility (AV:N) and low attack complexity (AC:L) indicate the bypass is mechanically simple once the technique is known. The PR:L rating is the primary risk limiter: exploitation requires a valid Groundhogg account at Sales Representative level or above, excluding entirely unauthenticated attack scenarios. The C:H impact rating is warranted - unrestricted SQL read access to a WordPress database typically exposes PII, hashed credentials, stored API keys, and marketing contact lists. Integrity and availability are not affected (I:N/A:N), making this a data-exfiltration vector only. No EPSS score was available in the source data. No CISA KEV listing is present, and no confirmed public exploit code has been identified, though Wordfence's advisory links directly to the vulnerable code locations, meaningfully accelerating independent PoC development. For organizations where external parties or lower-trust internal staff hold Sales Representative roles in Groundhogg, this is a genuine priority; for those where only highly trusted administrators hold plugin roles, the real-world risk is modestly reduced by the authentication prerequisite.

An attacker with Sales Representative credentials submits a crafted REST API request to the Groundhogg contacts endpoint, embedding an intentionally invalid filter type such as query[filters][0][0][type]=invalid_filter_nonexistent alongside a SQL payload in the query[select] parameter. The invalid filter type triggers a FilterException that is silently caught, redirecting query construction to the Legacy_Contact_Query path, which interpolates the query[select] value without escaping into the final SQL statement - enabling UNION-based extraction of arbitrary tables including WordPress user credentials, stored API keys, and full marketing contact records. No public PoC is confirmed, though the Wordfence advisory provides direct source code references that substantially reduce the effort required for independent exploit development.