Insecure Direct Object Reference in Groundhogg CRM Plugin for WordPress

CVE-2026-11454

What is CVE-2026-11454?

The Groundhogg CRM Plugin for WordPress presents a security vulnerability that allows authenticated attackers with the 'view_contacts' capability to access any user's contact data through the REST API. This flaw arises from an insufficient permissions check in the contacts endpoint, where the system fails to enforce ownership restrictions for contact records. Specifically, unscrupulous users can retrieve sensitive information, including personally identifiable information (PII) and administrative capabilities linked to affected contacts, even if they should only have access to their own records. Immediate action is advised to update to the latest version to mitigate this risk.

References