WP Manifestindependent plugin directory

Install

Download nextjs-groundhogg-integration-0.1.3-beta.zip From the 0.1.3-beta release on GitHub, Dec 27, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/systemsaholic/nextjs-groundhogg-integration/releases/download/0.1.3-beta/nextjs-groundhogg-integration-0.1.3-beta.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

NextJS Groundhogg Integration Plugin

A WordPress plugin that provides seamless integration between NextJS applications and Groundhogg CRM.

Features

  • 🔄 Bi-directional sync between NextJS and Groundhogg
  • 🔑 Secure API endpoints with authentication
  • 🌐 CORS support for NextJS applications
  • 📝 Contact management and tracking
  • 📧 Email integration
  • 📱 Phone number handling
  • 🪝 Webhook support for real-time updates
  • 📊 Activity logging
  • ⚡ Rate limiting and caching

Requirements

  • WordPress 5.0 or higher
  • PHP 7.4 or higher
  • Groundhogg CRM plugin
  • Valid Groundhogg API keys

Installation

Method 1: WordPress Admin

  1. Go to Plugins > Add New > Upload Plugin
  2. Select nextjs-groundhogg-integration.zip
  3. Click "Install Now"
  4. Activate the plugin

Method 2: Manual Installation

  1. Download the plugin zip file
  2. Extract to /wp-content/plugins/
  3. Activate through WordPress admin

Configuration

1. API Keys

  1. Navigate to Groundhogg > Settings > API Keys
  2. Generate new API keys if you haven't already
  3. Copy the Public Key and Token

2. CORS Settings

  1. Go to NextJS CRM > General Settings
  2. Add your NextJS application domains to Allowed Origins
  3. Save changes

3. Environment Variables

Add these to your NextJS application's .env.local:

# Groundhogg API Configuration
NEXT_PUBLIC_GROUNDHOGG_API_ENDPOINT=your-wordpress-url/wp-json/groundhogg/v4
NEXT_PUBLIC_GROUNDHOGG_API_VERSION=v4
NEXT_PUBLIC_GROUNDHOGG_PUBLIC_KEY=your-public-key
NEXT_PUBLIC_GROUNDHOGG_TOKEN=your-token

Available Endpoints

Basic Endpoints

  • GET /verify-connection
  • POST /quick-contact-sync
  • GET /contacts
  • GET /contact/{id}

Contact Management

  • GET /contact-activity/{email}
  • GET, POST /contact-notes/{email}
  • GET, POST /contact-custom-fields/{email}
  • PUT /update-contact

Form Handling

  • POST /submit-form
  • POST /submit-form-with-files
  • POST /form-submission

Phone-based Endpoints

  • GET /contact-by-phone/{phone}
  • POST /quick-contact-sync-phone

Email Management

  • GET, POST /emails
  • GET, PUT, DELETE /email/{id}
  • POST /email/{id}/send
  • GET /email-templates

Usage with NextJS SDK

This plugin is designed to work with the Groundhogg NextJS SDK.

import { GroundhoggSDK } from 'groundhogg-nextjs-sdk';

const sdk = new GroundhoggSDK({
  apiEndpoint: process.env.NEXT_PUBLIC_GROUNDHOGG_API_ENDPOINT,
  publicKey: process.env.NEXT_PUBLIC_GROUNDHOGG_PUBLIC_KEY,
  token: process.env.NEXT_PUBLIC_GROUNDHOGG_TOKEN
});

Webhook Support

The plugin includes webhook support for real-time updates:

  • Contact creation/updates
  • Tag applications/removals
  • Form submissions
  • Note additions
  • Activity tracking
  • Email events

Configure webhooks in NextJS CRM > Webhooks settings.

Security

  • API key authentication required
  • Rate limiting enabled by default
  • CORS protection
  • WordPress nonce verification
  • Input sanitization and validation

Support

For issues and feature requests, please use the GitHub issues page.

License

This project is licensed under the GPL v2 or later - see the LICENSE file for details.

Credits

Developed by Al Guertin

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.1.3-beta latest
Dec 27, 2024 1 year ago
nextjs-groundhogg-integration-0.1.3-beta.zip
4
Dec 27, 2024 1 year ago
nextjs-groundhogg-integration-0.1.2-beta.zip
4
Dec 27, 2024 1 year ago
nextjs-groundhogg-integration-0.1.1-beta.zip
4
Dec 27, 2024 1 year ago
nextjs-groundhogg-integration-beta.zip
4
D+ grade

Security

NextJS Groundhogg Integration 0.1.3-beta · audited by WP Registry

High-severity findings.

2 high
Audited release
0.1.3-beta
Findings
2
Worst severity
high
Content hash
7d4c5d08b1c517a23d5c9427…

Findings

  • high REST API authenticates with Groundhogg public_key only

    auth_bypass

    check_permission treats X-GH-API-KEY as valid when it equals an active Groundhogg api_keys.public_key. Groundhogg stores a separate token/secret and its native REST uses both. public_key is the non-secret half (and is commonly emitted in Groundhogg tracking JS). Anyone who can read that value gets this plugin's full CRM API: list contacts, read activity/notes, create/update contacts, apply tags, submit forms. Rate limit is a transient per key, not authorization.

    includes/api.php:66-113

    Recommendation

    Require the Groundhogg token/secret (HTTP Basic or a second header) in addition to public_key, matching Groundhogg core. Rotate keys if public_key was treated as a full credential. Do not list contacts/notes with identifier-only auth.

  • high Public-key-only routes expose and mutate Groundhogg contacts

    information_disclosure

    With the weak permission_callback, GET /contacts lists CRM rows, GET /contact-activity/{email} and /contact-notes/{email} return PII, POST /quick-contact-sync upserts contacts and apply_tag, POST /submit-form creates contacts. No current_user_can. This is unauthenticated CRM read/write once the public_key is known.

    includes/api.php:29-62

    Recommendation

    Keep the stronger auth (public_key+token). Scope write routes to a dedicated server-side secret, not a browser-visible key.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.