CVE-2025-0394: Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ghbigfileupload() function in all versions up to, and including, 3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0394?
CVE-2025-0394 has a high severity rating due to the potential for arbitrary file uploads, which can lead to unauthorized access or code execution.
How do I fix CVE-2025-0394?
To fix CVE-2025-0394, update the Groundhogg plugin to the latest version that addresses the file upload validation issue.
Which versions are affected by CVE-2025-0394?
CVE-2025-0394 affects all versions of the Groundhogg plugin up to and including 3.7.3.5.
What exploit methods are possible with CVE-2025-0394?
Exploitation of CVE-2025-0394 could allow attackers to upload malicious files, potentially leading to server compromise.
Who is the vendor responsible for CVE-2025-0394?
The vendor responsible for CVE-2025-0394 is Groundhogg, which develops the affected plugin for WordPress.