Groundhogg — CRM, Newsletters, and Marketing Automation Plugin (<= 4.9.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/groundhogg--crm-newsletters-and-marketing-automation-plugin--4.9.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 06:25:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary File Deletion in Groundhogg WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-groundhogg-file-deletion/Fri, 16 Oct 2026 06:25:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-groundhogg-file-deletion/The Groundhogg WordPress plugin contains an arbitrary file deletion vulnerability in the copy_file function that allows authenticated users with specific capabilities to remove critical server files.Groundhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress is susceptible to an arbitrary file deletion vulnerability (CVE-2026-109221). The issue stems from insufficient input validation within the 'copy_file' function in plugin versions up to and including 4.9.3. The vulnerability is accessible to authenticated users possessing the 'import_contacts' capability, a permission granted by default to the 'Sales Representative' role. By manipulating file paths, an attacker can delete sensitive files from the WordPress installation directory. Successful exploitation allows for the deletion of critical files such as 'wp-config.php', which can be leveraged to reset the installation process or facilitate remote code execution by bypassing security configurations. Defenders should prioritize auditing the permissions associated with the 'Sales Representative' role and patching to the version addressing this path validation flaw.

Impact

The vulnerability allows authenticated attackers with limited administrative privileges to impact the integrity and availability of the WordPress site. Deletion of 'wp-config.php' forces the application to return to an uninitialized state, permitting unauthorized attackers to reconfigure the database connection and take full control of the web application and underlying server environment.

Recommendation

  • Patch the Groundhogg plugin to the latest version immediately to resolve the path validation flaw in 'copy_file'.
  • Audit WordPress user roles and capabilities to identify and restrict accounts assigned the 'Sales Representative' role or the 'import_contacts' capability.
  • Monitor web server access logs for anomalous POST requests targeting the plugin's file manipulation endpoints.
]]>highadvisoryweb-applicationwordpresscve-2026-109221