The vulnerability is an insecure direct object reference that allows authenticated users with the view_contacts capability to retrieve any contact record by integer ID through a REST endpoint. This flaw bypasses the ordinary object‑level ownership checks, enabling attackers to read sensitive personal information, contact metadata, owner identifiers, administrative URLs, and, for contacts linked to WordPress users, the full set of that user's capabilities. The weakness is therefore a classic example of CWE‑639, leading to a confidentiality breach.

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress, versions up to and including 4.5.2, is affected. Attackers can exploit the issue by sending GET requests to /wp-json/gh/v4/contacts/<id> on any WordPress site running one of these versions. The built‑in Sales Rep role, which is designed to see only its own contacts, can gain read access to all contacts because it possesses view_contacts but not view_others_contacts.

The CVSS score of 6.5 reflects the medium‑high risk presented by this IDOR flaw. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no active exploitation campaign has been publicly reported. However, the attack vector is authenticated and remote, requiring only a role with view_contacts capability to craft a request. An attacker possessing such a role—such as a legitimate Sales Rep—could exfiltrate all contact data and potentially compromise further access rights of linked WordPress users.