CVE-2026-11454 trainingbusinesspros CVE debrief

Who should care

Administrators of WordPress sites using the Groundhogg plugin, particularly those with sensitive contact information stored in the plugin, should be aware of this vulnerability and take steps to mitigate it. This includes applying the vendor patch, restricting access to the affected endpoint, and monitoring for suspicious activity.

Technical summary

The Groundhogg plugin for WordPress is vulnerable to insecure direct object reference in the /wp-json/gh/v4/contacts/<id> REST endpoint. An authenticated attacker with the view_contacts capability can read any contact record on the site, including PII, contact meta, owner IDs, and the admin edit URL. The vulnerability affects all versions up to, and including, 4.5.2 of the plugin. The plugin's insecure direct object reference allows attackers to bypass the object-level view_contact ownership check, enabling them to access sensitive contact information. This vulnerability has been confirmed by security researchers at Wordfence, who have provided details on the affected endpoint and the potential impact on site security.

Defensive priority

Medium priority due to the potential for sensitive information disclosure.

Recommended defensive actions

• Apply the vendor patch to update the Groundhogg plugin to a version beyond 4.5.2.
• Restrict access to the /wp-json/gh/v4/contacts/<id> REST endpoint to only users with the view_others_contacts capability.
• Monitor for suspicious activity on the affected endpoint.
• Perform a thorough review of contact records for potential unauthorized access.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The Groundhogg plugin for WordPress has a vulnerability allowing authenticated attackers with view_contacts capability to read any contact record, including PII and other sensitive information, due to an insecure direct object reference in the /wp-json/gh/v4/contacts/<id> REST endpoint. Evidence from the NVD and Wordfence indicates that the Groundhogg plugin is vulnerable to insecure direct object reference, allowing unauthorized access to contact records. The vulnerability affects all versions up to, and including, 4.5.2 of the plugin. The endpoint's permission callback checks only the role-level view_contacts capability and read_single() returns the full contact record by sequential integer ID without the object-level view_contact ownership check applied elsewhere in the codebase.

Official resources