Groundhogg — CRM, Newsletters, and Marketing Automation Plugin (<= 4.9.3)

The Groundhogg WordPress plugin contains an arbitrary file deletion vulnerability in the copy_file function that allows authenticated users with specific capabilities to remove critical server files.