CVE-2026-13333 describes a SQL Injection vulnerability in the Groundhogg WordPress plugin affecting all versions up to 4.5.5. The issue arises from insufficient escaping of the 'query[select]' parameter and a bypass of the sanitized Contact_Query code path by triggering a FilterException with an invalid filter type. This causes execution to fall back to an unsanitized Legacy_Contact_Query path, enabling authenticated attackers with Sales Representative-level privileges or higher to append arbitrary SQL queries to existing ones. The vulnerability allows unauthorized reading of sensitive data from the database but does not affect data integrity or availability. No official patch or remediation guidance is currently provided by the vendor.

An attacker with authenticated access at Sales Representative level or above can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands. The confidentiality of data is compromised, but there is no indication of impact on data integrity or availability. This could lead to unauthorized disclosure of sensitive customer or business information stored within the Groundhogg plugin's database tables.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Sales Representative-level access and above to trusted users only. Avoid supplying invalid filter types in queries to prevent fallback to the unsanitized query path. Monitor for updates from the vendor or security community regarding patches or workarounds.