CVE-2026-109221

Basic Information

Severity HIGH
Base Score 8.1
CNA Wordfence
Published Date 2026-10-16 00:27:05 UTC
Last Modified 2026-10-16 13:07:01 UTC
CVE.org Link https://www.cve.org/CVERecord?id=CVE-2026-109221
NVD https://nvd.nist.gov/vuln/detail/CVE-2026-109221

Description

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.

Affected Products

Vendor Product
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation

References

Back to Lookup View on CVE.org