CVE-2025-4206: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'processexportdelete' and 'processimportdelete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4206?
CVE-2025-4206 has a high-severity rating due to its ability to allow arbitrary file deletion.
What versions of Groundhogg are affected by CVE-2025-4206?
All versions of Groundhogg up to and including 4.1.1.2 are affected by CVE-2025-4206.
How do I fix CVE-2025-4206?
To fix CVE-2025-4206, you should update the Groundhogg plugin to the latest version that includes the patch.
What functions are involved in CVE-2025-4206?
CVE-2025-4206 involves the 'process_export_delete' and 'process_import_delete' functions that lack proper file path validation.
What type of vulnerability is CVE-2025-4206?
CVE-2025-4206 is classified as an arbitrary file deletion vulnerability.