CVE-2026-13333 describes an SQL Injection vulnerability in the Groundhogg WordPress plugin (versions <=4.5.5). The issue arises because the 'query[select]' parameter is not properly escaped, and the sanitized Contact_Query path can be bypassed by supplying an invalid filter type, causing execution to fall back to an unsanitized legacy query path. This enables authenticated attackers with Sales Representative-level privileges or higher to append SQL commands to existing queries, potentially extracting sensitive data from the database. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity. No official patch or remediation guidance is currently documented.

An attacker with authenticated access at Sales Representative level or above can exploit this vulnerability to perform SQL Injection attacks, allowing unauthorized reading of sensitive information from the database. The vulnerability does not impact data integrity or availability but compromises confidentiality by exposing sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to limit access to Sales Representative-level permissions and above, and monitor for unusual database query activity related to the 'query[select]' parameter. Avoid supplying invalid filter types that trigger fallback to the unsanitized legacy query path.