Arbitrary File Deletion in Groundhogg CRM Plugin for WordPress

CVE-2026-109221

What is CVE-2026-109221?

The Groundhogg CRM plugin for WordPress is vulnerable to arbitrary file deletion due to inadequate file path validation within its copy_file function. This flaw affects all versions up to and including 4.9.3, allowing authenticated users with at least Sales Representative-level permissions to delete critical files on the server. This vulnerability poses a significant risk as it could lead to remote code execution if sensitive files, such as wp-config.php, are targeted. The issue arises from the plugin's default role assignment, which grants the import_contacts capability, enabling exploitation by users with basic access rights.

References