What the vulnerability does
01Description
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'process_export_delete' and 'process_import_delete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
02Summary
Groundhogg versions up to 4.1.1.2 contain a path traversal vulnerability that allows high-privilege users to read and modify arbitrary files on the server. An attacker with admin or elevated access can bypass file restrictions and access sensitive data outside the intended application directory. This affects confidentiality, integrity, and availability of the site.
What an attacker can do
03Attacker Capabilities
Read and modify arbitrary files on the server outside the application directory.
Potential impact on your site
04Site Impact
A compromised admin account can expose sensitive files, modify core files, or disable the site entirely.
Conditions required to exploit
05Prerequisites
Attacker must have high-level privileges (admin or equivalent role) in Groundhogg.
Key dates
06Disclosure timeline
May 9, 2025
CVE published
April 8, 2026
Record updated
