The Groundhogg WordPress plugin contains an arbitrary file deletion vulnerability in the copy_file function that allows authenticated users with specific capabilities to remove critical server files.
Groundhogg — CRM, Newsletters, and Marketing Automation plugin
web-application
wordpress
cve-2026-109221
2t
1c