High 8.1Published Oct 16, 2026

CVE-2026-109221Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping

Updated under an hour ago (Oct 28, 2026, 5:30 AM ET)

Does this affect you?

It affects trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.77%, higher than 55% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation

Exploited in the last 30 days

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.77% (percentile 55)
Assigned by: Wordfence
NVD analysis: Deferred
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 16, 2026

Affected products

Affected products

trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros:groundhogg_crm_newsletters_and_marketing_automation (from the name)	through 4.9.3	CNA record

References

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5100ac-cfe6-4e91-9349-6e8efa850147?source=cve
https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L94
https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L85
https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/utils/files.php#L323
https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L2872
https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L8045
https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/background/import-contacts.php#L200
https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L575
https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L602
https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/main-roles.php#L583
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.