{"id":"CVE-2026-11454","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-11454","generatedAt":"2026-10-28T09:42:31.725Z","title":"The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/<id> REST endpoint.","description":"The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/<id> REST endpoint. The endpoint's permission callback checks only the role-level view_contacts capability and read_single() returns the full contact record by sequential integer ID without the object-level view_contact ownership check applied elsewhere in the codebase. This makes it possible for authenticated attackers holding view_contacts but not view_others_contacts — notably Groundhogg's built-in Sales Rep role, designed to see only its own contacts — to read any contact record on the site, including PII, contact meta, owner IDs, the admin edit URL, and (for contacts linked to a WordPress user) that user's full capability set.","published":"2026-08-05T08:16:29.000Z","lastModified":"2026-08-12T21:00:37.000Z","status":"Deferred","sourceIdentifier":"security@wordfence.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-639"],"affected":[],"epss":{"score":0.0054,"percentile":0.45216,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.54%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.2/api/v4/base-object-api.php#L124","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.2/api/v4/contacts-api.php#L426","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.2/api/v4/contacts-api.php#L946","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.2/includes/main-roles.php#L163","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.2/includes/main-roles.php#L374","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.2/includes/main-roles.php#L43","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.5.3/api/v4/contacts-api.php#L437","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?new=3569222%40groundhogg%2Ftags%2F4.5.3&old=3562726%40groundhogg%2Ftags%2F4.5.2","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe3d251-4edf-4d94-a946-0aa918135784?source=cve","source":"security@wordfence.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-11454","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}