What is the CVSS score of EUVD-2026-39928?

EUVD-2026-39928 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Groundhogg CRM EUVD-2026-39928

| CVE-2026-13331 MEDIUM

SQL Injection (CWE-89)

2026-06-27 Wordfence

GHSA-cc9f-rh6g-8362

WordPress SQLi Wordpress Plugin Groundhogg Crm Newsletters And Marketing Automation Trainingbusinesspros

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable via HTTP, low complexity, marketer-level auth required (PR:L), read-only confidentiality impact with no integrity or availability effect confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 27, 2026 - 02:13 vuln.today

CVE Published

Jun 27, 2026 - 01:27 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'search' parameter in all versions up to, and including, 4.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with marketer-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in the Groundhogg CRM, Newsletters, and Marketing Automation WordPress plugin exposes the underlying WordPress database to authenticated attackers holding marketer-level access or higher. The 'search' parameter is insufficiently escaped across at least five distinct code paths - spanning db/db.php, db/steps.php, and api/v4/base-object-api.php - allowing appended SQL payloads to exfiltrate sensitive data including contact records, campaign data, and potentially WordPress user credentials. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the vulnerability is straightforward to exploit with valid credentials given the low complexity rating.

Technical ContextAI

CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) describes this root cause: user-supplied input to the 'search' parameter reaches database query construction without adequate escaping or parameterized preparation. The CPE string (cpe:2.3:a:trainingbusinesspros:groundhogg_-_crm,_newsletters,_and_marketing_automation:*:*:*:*:*:*:*:*) confirms the vulnerable component as the trainingbusinesspros vendor's Groundhogg plugin running on WordPress. Wordfence's references identify at least five vulnerable code locations: db/db.php at lines 330 and 395, db/steps.php at lines 231 and 254, and api/v4/base-object-api.php at line 488, indicating the SQL injection surface is not isolated to a single function but is systemic across database interaction and REST API layers. The 'marketer' role is a Groundhogg-specific capability tier below WordPress administrator but above subscriber, meaning this flaw is exploitable by plugin-specific privileged users, not just site admins.

RemediationAI

Update the Groundhogg plugin to the first release following version 4.5.5, as the upstream fix is confirmed via WordPress plugin Trac changeset 3586389 (https://plugins.trac.wordpress.org/changeset?reponame=&new=3586389%40groundhogg&old=3586389%40groundhogg); however, the exact patched release version number is not independently confirmed from available data and should be verified at the WordPress plugin repository before deploying. As a compensating control pending upgrade, restrict assignment of the Groundhogg 'marketer' role to only fully trusted and necessary users, since this role is the minimum privilege level required for exploitation. Reviewing current role assignments within the plugin's user management interface is advisable as an immediate action. Disabling API endpoints exposed by api/v4/base-object-api.php via WAF rules or network-level access controls (e.g., blocking REST API routes containing the 'search' parameter for non-admin roles) can reduce attack surface, though this may break legitimate marketer workflows. There are no generic workarounds that eliminate the underlying injection risk without patching.