CVE-2026-11454: Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/<id> REST endpoint. The endpoint's permission callback checks only the role-level viewcontacts capability and readsingle() returns the full contact record by sequential integer ID without the object-level viewcontact ownership check applied elsewhere in the codebase. This makes it possible for authenticated attackers holding viewcontacts but not viewotherscontacts — notably Groundhogg's built-in Sales Rep role, designed to see only its own contacts — to read any contact record on the site, including PII, contact meta, owner IDs, the admin edit URL, and (for contacts linked to a WordPress user) that user's full capability set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Groundhogg — CRM, Newsletters, and Marketing Automationto a version that resolves this vulnerability.Fixed in 4.5.2 - Compensating control
Mitigate the Insecure Direct Object Reference on GET /wp-json/gh/v4/contacts/<id> by restricting access to the REST endpoint so that users who have only view_contacts (e.g., Sales Rep) cannot view other contacts; ensure an object-level view_contact ownership check (ownership or equivalent) is enforced for each requested contact ID.