{"id":"CVE-2026-109221","kind":"vulnerability","aliases":["CVE-2026-109221"],"related":[],"title":"WordPress Groundhogg plugin: arbitrary file deletion enables code execution","description":"The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.","summary":"The Groundhogg WordPress CRM plugin up to and including 4.9.3 fails to validate file paths in its copy_file function, so an authenticated user can delete arbitrary files on the server. Deleting a file such as wp-config.php can lead to remote code execution.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-sales-rep-accounts","plugin-updated"],"how_to_check":"- Check the installed Groundhogg plugin version in the WordPress admin under Plugins, or with `wp plugin get groundhogg --field=version`\n- Look for users holding the import_contacts capability, such as the Sales Representative role","fix":"- Update the Groundhogg plugin to a version later than `4.9.3`\n- Until updated, restrict or remove the Sales Representative role and any accounts holding import_contacts","status":"open","published_at":"2026-10-16T05:17:29+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:07:50+00:00","updated_at":"2026-10-25T03:07:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:07:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Groundhogg plugin to a version later than `4.9.3`\n- Until updated, restrict or remove the Sales Representative role and any accounts holding import_contacts","reach":"internet","title":"WordPress Groundhogg plugin: arbitrary file deletion enables code execution","impact":"high","summary":"The Groundhogg WordPress CRM plugin up to and including 4.9.3 fails to validate file paths in its copy_file function, so an authenticated user can delete arbitrary files on the server. Deleting a file such as wp-config.php can lead to remote code execution.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker deletes wp-config.php and takes over the WordPress server","analyst_note":"","how_to_check":"- Check the installed Groundhogg plugin version in the WordPress admin under Plugins, or with `wp plugin get groundhogg --field=version`\n- Look for users holding the import_contacts capability, such as the Sales Representative role","needs_analyst":false,"not_affected_if":["plugin-updated","no-sales-rep-accounts"],"who_is_affected":"Sites running the Groundhogg plugin at version 4.9.3 or earlier are exposed. Exploitation needs an account with the import_contacts capability, which the plugin grants by default to its Sales Representative role, so sites without that role or those accounts are not exposed to this path.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000623,"input_tokens":3430,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109221':12A,15A '-2026':11A,14A '4.9.3':33B,101C 'access':114C 'arbitrari':4A,50B,80C,119C 'attack':108C 'authent':46B,107C 'autom':73C 'capabl':154C 'code':8A,65B,130C 'contact':153C 'copi':41B,91C 'crm':27B,69C 'custom':164C 'cve':10A,13A 'default':159C 'defin':151C 'delet':6A,49B,55B,82C,118C,137C 'due':83C 'easili':126C 'enabl':7A 'execut':9A,66B,131C 'exploit':143C 'fail':34B 'file':5A,37B,42B,51B,57B,81C,86C,92C,120C,135C 'function':43B,93C 'grant':157C 'groundhogg':2A,25B,68C 'hold':147C 'host':19B 'import':152C 'includ':32B,100C 'insuffici':85C 'lead':62B,127C 'level':113C 'make':103C 'market':72C 'newslett':70C 'packag':16B 'path':38B,87C 'plugin':3A,23B,28B,74C,150C,162C 'plugin-defin':149C 'possibl':105C 'remot':64B,129C 'repres':112C,166C 'representative-level':111C 'right':134C 'role':167C 'sale':110C,165C 'self':18B 'self-host':17B 'server':54B,123C 'user':47B,146C 'valid':36B,88C 'version':96C 'vulner':78C 'wordpress':1A,20B,22B,26B,76C 'wordpress-plugin':21B 'wp-config.php':60B,140C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Groundhogg plugin at version 4.9.3 or earlier are exposed. Exploitation needs an account with the import_contacts capability, which the plugin grants by default to its Sales Representative role, so sites without that role or those accounts are not exposed to this path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109221","severity":null,"published_at":"2026-10-16T05:17:29+00:00","modified_at":"2026-10-16T18:17:30+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}