EUVD-2026-53177
GHSA-52xv-wqqv-x9g6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
REST API accessible over network (AV:N), no special conditions beyond authentication (AC:L), requires low-privilege view_contacts account (PR:L), high confidentiality from full PII record exposure; no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/<id> REST endpoint. The endpoint's permission callback checks only the role-level view_contacts capability and read_single() returns the full contact record by sequential integer ID without the object-level view_contact ownership check applied elsewhere in the codebase. This makes it possible for authenticated attackers holding view_contacts but not view_others_contacts - notably Groundhogg's built-in Sales Rep role, designed to see only its own contacts - to read any contact record on the site, including PII, contact meta, owner IDs, the admin edit URL, and (for contacts linked to a WordPress user) that user's full capability set.
AnalysisAI
Insecure Direct Object Reference in the Groundhogg WordPress plugin (all versions through 4.5.2) allows authenticated users holding the view_contacts capability - most notably the built-in Sales Rep role - to enumerate and retrieve any contact record site-wide via the REST API, bypassing the intended ownership restriction that should limit them to their own assigned contacts. The GET /wp-json/gh/v4/contacts/<id> endpoint performs only a role-level capability check and accepts sequential integer IDs, meaning a Sales Rep can trivially iterate through all contact IDs and extract PII, contact metadata, owner identifiers, admin edit URLs, and - for contacts linked to a WordPress account - that user's full capability set. No public exploit code or active exploitation has been identified at time of analysis, but the attack is low-complexity for any attacker who can register or obtain a Sales Rep account.
Technical ContextAI
Groundhogg implements a tiered WordPress capability model for contact access: view_contacts (role-level read permission) and view_others_contacts (allows reading contacts owned by other users). The REST API endpoint GET /wp-json/gh/v4/contacts/<id>, defined in api/v4/contacts-api.php, performs its permission callback check against only the view_contacts capability. The read_single() method returns the full serialized contact object referenced by its sequential integer primary key without invoking the object-level view_contact ownership verification that the codebase applies in other contexts (e.g., base-object-api.php line 124). CWE-639 (Authorization Bypass Through User-Controlled Key) describes this class precisely: a user supplies an externally visible, predictable object key (sequential integer ID) and the access control layer fails to verify that the authenticated subject is authorized to act on that specific object instance. The affected CPE is cpe:2.3:a:trainingbusinesspros:groundhogg_-_crm,_newsletters,_and_marketing_automation:*:*:*:*:*:*:*:* covering all versions through 4.5.2. The fix, confirmed in tag 4.5.3 at contacts-api.php line 437, adds the missing object-level ownership check to the REST endpoint.
RemediationAI
Vendor-released patch: 4.5.3. Site administrators running Groundhogg should update immediately to version 4.5.3, which adds the missing object-level ownership check to the REST API endpoint as confirmed by the WordPress SVN changeset at https://plugins.trac.wordpress.org/changeset?new=3569222%40groundhogg%2Ftags%2F4.5.3&old=3562726%40groundhogg%2Ftags%2F4.5.2. If an immediate upgrade is not possible, a targeted workaround is to revoke the Sales Rep role (or any other role holding view_contacts but not view_others_contacts) from all non-admin users and restrict the wp-json/gh/v4/contacts/ REST namespace at the web server or WAF layer to administrative IP ranges only - note this will break legitimate Groundhogg REST-dependent integrations and must be assessed against operational impact. Do not rely on capability auditing alone: the flaw is in the endpoint logic, not role assignment, so any account with view_contacts is affected regardless of how the role was granted.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today