Lucius-Log

**Name of the Vulnerable Software and Affected Versions** Groundhogg — CRM, Newsletters, and Marketing Automation versions prior to 4.5.3 **Description** An Insecure Direct Object Reference exists in the plugin via the 'GET /wp-json/gh/v4/contacts/<id>' REST endpoint. The permission callback for this endpoint only verifies the role-level `view contacts` capability, and the `read single()` function returns full contact records using sequential integer IDs without performing an object-level ownership check. This allows authenticated users with the `view contacts` capability but without the `view others contacts` capability, such as those assigned the Sales Rep role, to access any contact record on the site. Exposed data includes personally identifiable information (PII), contact meta, owner IDs, admin edit URLs, and the full capability set of linked WordPress users. **Recommendations** Update the plugin to version 4.5.3 or later. As a temporary mitigation, restrict access to the 'GET /wp-json/gh/v4/contacts/<id>' REST endpoint for users with the Sales Rep role.