Arbitrary File Deletion in Groundhogg WordPress Plugin

Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress is susceptible to an arbitrary file deletion vulnerability (CVE-2026-109221). The issue stems from insufficient input validation within the 'copy_file' function in plugin versions up to and including 4.9.3. The vulnerability is accessible to authenticated users possessing the 'import_contacts' capability, a permission granted by default to the 'Sales Representative' role. By manipulating file paths, an attacker can delete sensitive files from the WordPress installation directory. Successful exploitation allows for the deletion of critical files such as 'wp-config.php', which can be leveraged to reset the installation process or facilitate remote code execution by bypassing security configurations. Defenders should prioritize auditing the permissions associated with the 'Sales Representative' role and patching to the version addressing this path validation flaw.

Impact

The vulnerability allows authenticated attackers with limited administrative privileges to impact the integrity and availability of the WordPress site. Deletion of 'wp-config.php' forces the application to return to an uninitialized state, permitting unauthorized attackers to reconfigure the database connection and take full control of the web application and underlying server environment.

Recommendation

• Patch the Groundhogg plugin to the latest version immediately to resolve the path validation flaw in 'copy_file'.
• Audit WordPress user roles and capabilities to identify and restrict accounts assigned the 'Sales Representative' role or the 'import_contacts' capability.
• Monitor web server access logs for anomalous POST requests targeting the plugin's file manipulation endpoints.