CVE-2026-13331

🗓️ 27 Jun 2026 01:27:20Reported by WordfenceType

Authenticated marketers can exploit SQL injection via search parameter in Groundhogg version 4.5.5.

Reporter	Title	Published	Views	Family All 5
ATTACKERKB	CVE-2026-13331	27 Jun 202601:27	–	attackerkb
Cvelist	CVE-2026-13331 Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter	27 Jun 202601:27	–	cvelist
EUVD	EUVD-2026-39928	27 Jun 202601:27	–	euvd
NVD	CVE-2026-13331	27 Jun 202602:16	–	nvd
Positive Technologies	PT-2026-53039	27 Jun 202600:00	–	ptsecurity

Vulners

Node

trainingbusinesspros groundhogg_crm,_newsletters,_and_marketing_automationRange≤4.5.5wordpress

[
  {
    "vendor": "trainingbusinesspros",
    "product": "Groundhogg — CRM, Newsletters, and Marketing Automation",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.5.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.5/db/steps.php
plugins	www.plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.5/db/steps.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/20ee6bc7-2732-4da3-b005-a971d12b0e32
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.5/db/db.php
plugins	www.plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.5/db/db.php
plugins	www.plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.5/api/v4/base-object-api.php

27 Jun 2026 02:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

CWE-89