{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/groundhogg--crm-newsletters-and-marketing-automation-plugin--4.9.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:groundhogg:crm_newsletters_and_marketing_automation_plugin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-109221"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Groundhogg — CRM, Newsletters, and Marketing Automation plugin (\u003c= 4.9.3)"],"_cs_severities":["high"],"_cs_tags":["web-application","wordpress","cve-2026-109221"],"_cs_type":"advisory","_cs_vendors":["Groundhogg"],"content_html":"\u003cp\u003eGroundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress is susceptible to an arbitrary file deletion vulnerability (CVE-2026-109221). The issue stems from insufficient input validation within the 'copy_file' function in plugin versions up to and including 4.9.3. The vulnerability is accessible to authenticated users possessing the 'import_contacts' capability, a permission granted by default to the 'Sales Representative' role. By manipulating file paths, an attacker can delete sensitive files from the WordPress installation directory. Successful exploitation allows for the deletion of critical files such as 'wp-config.php', which can be leveraged to reset the installation process or facilitate remote code execution by bypassing security configurations. Defenders should prioritize auditing the permissions associated with the 'Sales Representative' role and patching to the version addressing this path validation flaw.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows authenticated attackers with limited administrative privileges to impact the integrity and availability of the WordPress site. Deletion of 'wp-config.php' forces the application to return to an uninitialized state, permitting unauthorized attackers to reconfigure the database connection and take full control of the web application and underlying server environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the Groundhogg plugin to the latest version immediately to resolve the path validation flaw in 'copy_file'.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user roles and capabilities to identify and restrict accounts assigned the 'Sales Representative' role or the 'import_contacts' capability.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests targeting the plugin's file manipulation endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:25:32Z","date_published":"2026-10-16T06:25:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-groundhogg-file-deletion/","summary":"The Groundhogg WordPress plugin contains an arbitrary file deletion vulnerability in the copy_file function that allows authenticated users with specific capabilities to remove critical server files.","title":"Arbitrary File Deletion in Groundhogg WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-groundhogg-file-deletion/"}],"language":"en","title":"CraftedSignal Threat Feed - Groundhogg — CRM, Newsletters, and Marketing Automation Plugin (\u003c= 4.9.3)","version":"https://jsonfeed.org/version/1.1"}