CVE-2026-109221: Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copyfile function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined importcontacts capability, which is granted by default to the plugin's custom Sales Representative role.
Affected Software
Event History
Frequently Asked Questions
Which accounts can exploit this issue by default?
Any authenticated account with the plugin-defined import_contacts capability can exploit it. Groundhogg grants this capability by default to its custom Sales Representative role, and higher-privileged plugin roles are also affected.
Does exploitation require interaction from another user or a complex attack setup?
No. The issue is network-accessible, has low attack complexity, and requires no user interaction, but the attacker must first authenticate with an account that has import_contacts permission.
What is the likely impact if exploitation succeeds?
An attacker can delete arbitrary files on the server. Deleting a file such as wp-config.php can lead to remote code execution.
What should be reviewed while remediation is pending?
Review which accounts hold the Groundhogg Sales Representative role or otherwise have the import_contacts capability, since those accounts can perform the vulnerable CSV import action. Restrict that capability to trusted users until the issue is remediated.