CVE-2026-11454

CVE-2026-11454 is an IDOR in the Groundhogg WordPress CRM plugin's REST API endpoint `/wp-json/gh/v4/contacts/<id>`. The vulnerability allows any authenticated user with the base `view_contacts` capability to read any contact record by iterating through sequential IDs — no object-level ownership check is enforced on this endpoint, unlike other code paths in the plugin that properly validate `view_contact` ownership. The CVSS 6.5 score badly understates the actual risk. What makes this critical rather than moderate is what the endpoint returns for contacts linked to WordPress users: their full capability set. In WordPress, capabilities are the actual authorization tokens that gate every administrative action. Harvesting capability profiles across a contact database doesn't just leak PII — it maps your entire permission topology. An attacker with Sales Rep-level access (a role Groundhogg explicitly markets for contact isolation) can enumerate contacts, identify which are linked to WordPress users, and collect the capability sets of admins, editors, and privileged users. This transforms the vulnerability from a data disclosure into structured reconnaissance for targeted privilege escalation. The sequential ID design with no rate limiting compounds this: the entire contact database is harvestable in a single authenticated session. The Sales Rep role shipped with this REST endpoint broken — the object-level ownership check existed elsewhere in the codebase but was never applied to the API surface. Check your Groundhogg installation for the `/wp-json/gh/v4/contacts/` endpoint exposure. The fix requires adding the `view_contact` capability check to the REST permission callback, matching the authorization model already implemented in non-API functions. Audit other REST endpoints for the same authorization gap. If you have enterprise customers relying on Groundhogg's contact isolation guarantees, this vulnerability likely creates GDPR/CCPA compliance exposure — the isolation promise was structurally broken on the API surface from the moment the REST endpoint shipped.

Reviewed through automated stages and approved by a human before publication.