CVE-2026-13331 describes an SQL Injection vulnerability in the Groundhogg WordPress plugin (CRM, Newsletters, and Marketing Automation) affecting all versions up to and including 4.5.5. The issue arises from improper neutralization of special elements in the 'search' parameter, allowing authenticated users with marketer-level privileges or above to append arbitrary SQL queries to existing database queries. This is due to insufficient escaping and lack of prepared statements in the plugin's handling of the parameter. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No vendor advisory or patch information is currently available.

An authenticated attacker with marketer-level or higher access can exploit this vulnerability to execute additional SQL queries on the database. This can lead to unauthorized disclosure of sensitive information stored in the database. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict marketer-level access to trusted users only and monitor for suspicious activity related to the 'search' parameter. Avoid exposing this parameter to untrusted input where possible.