CVE-2026-11454
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The Groundhogg plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.5.2. The REST endpoint GET /wp-json/gh/v4/contacts/<id> only checks the view_contacts capability, not view_others_contacts, allowing authenticated attackers (e.g., Sales Rep role) to read any contact record, including PII, contact meta, owner IDs, admin edit URLs, and full capability sets of linked WordPress users.
Risk Assessment
Exposure of sensitive customer PII and user account details can lead to privacy breaches and GDPR non-compliance. Attackers with limited privileges can access data they should not see.
Recommendation
Update the Groundhogg plugin to a patched version. Additionally, restrict access to the REST endpoint and implement object-level access controls.
Other vulnerabilities in Groundhogg
See all- CVE-2026-18387Medium
The Groundhogg plugin for WordPress up to version 4.5.14 is vulnerable to SQL injection via the tag_query parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with vendor-level access to append additional SQL queries, potentially extracting sensitive information. Exploitation requires triggering the Legacy_Contact_Query code path via an unknown filter type.
- CVE-2026-57389High
The Groundhogg WordPress plugin up to version 4.4.1 contains a Path Traversal vulnerability that allows unauthorized access to files outside the restricted directory.
- CVE-2026-14029Medium
The Groundhogg plugin for WordPress (versions up to 4.5.8) is vulnerable to SQL injection via the 'select' parameter. An authenticated attacker with custom-level access or higher can append additional SQL queries, enabling extraction of sensitive database information.
- CVE-2026-13333Medium
The Groundhogg plugin for WordPress (versions up to 4.5.5) is vulnerable to generic SQL injection via the 'query[select]' parameter. Insufficient escaping and lack of prepared statements allow authenticated attackers with Sales Representative-level access or higher to append additional SQL queries, potentially extracting sensitive database information.
- CVE-2026-13331Medium
The Groundhogg plugin for WordPress (CRM, newsletters, and marketing automation) in versions up to and including 4.5.5 is vulnerable to generic SQL injection via the 'search' parameter. This is due to insufficient escaping of user-supplied input and lack of proper preparation of SQL queries.
- CVE-2026-57667High
The Groundhogg plugin for WordPress versions 4.5 and earlier contains an SQL injection vulnerability in the Sales Representative module. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2026-40793Medium
Versions of Groundhogg below 4.4.1 have a broken access control issue for subscribers, potentially allowing unauthorized access to data.
- CVE-2026-40727High
In Groundhogg versions <= 4.4, there is a vulnerability that allows sales representatives to delete arbitrary files.
Original NVD description (English source)
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/<id> REST endpoint. The endpoint's permission callback checks only the role-level view_contacts capability and read_single() returns the full contact record by sequential integer ID without the object-level view_contact ownership check applied elsewhere in the codebase. This makes it possible for authenticated attackers holding view_contacts but not view_others_contacts — notably Groundhogg's built-in Sales Rep role, designed to see only its own contacts — to read any contact record on the site, including PII, contact meta, owner IDs, the admin edit URL, and (for contacts linked to a WordPress user) that user's full capability set.