High
Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
Type: advisorySources: OSV
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-109221
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 08:27 UTC · Revision 1
Source evidence
Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
core-osv · Original sourcePublished 16 Oct 2026, 04:27 UTC
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.
osv:CVE-2026-109221
Complete source record
{
"id": "24613872f6ce3467f6b231590b2f4ecb8fe35a090d0ddaaef7c1e741ec9a48f4",
"url": "https://osv.dev/vulnerability/CVE-2026-109221",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping",
"summary": "The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.",
"evidence": "osv:CVE-2026-109221",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-109221",
"aliases": [
"CVE-2026-109221"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/groundhoggwp/groundhogg",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "e319e4a849bfbb07cccfbac8558ad6bf07a7fdc0"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.9.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "e319e4a849bfbb07cccfbac8558ad6bf07a7fdc0"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"4.9.3",
"4.9.2",
"4.9.2.rc.1",
"4.9.1",
"4.9.rc.4",
"4.9",
"4.9.rc.3",
"4.9.rc.2",
"4.9.rc.1",
"4.8.3",
"4.8.2",
"4.8.1",
"4.8",
"4.7.2.beta.1",
"4.7.2",
"4.7.1",
"4.7",
"4.6.1",
"4.6",
"4.6.beta.1",
"4.5.15",
"4.5.15.beta.2",
"4.5.15.beta.1",
"4.5.14",
"4.5.13",
"4.5.12",
"4.5.11",
"4.5.10",
"4.5.9",
"4.5.8",
"4.5.7",
"4.5.6",
"4.5.5",
"4.5.4",
"4.5.3",
"4.5.2",
"4.5.1",
"4.5",
"4.5.dev.2",
"4.5.dev.1",
"4.4.2",
"4.4.1",
"4.4",
"4.3.3",
"4.3.3.rc.1",
"4.3.2",
"4.3.1",
"4.3.1.beta.1",
"4.3",
"4.3.rc.1",
"4.3.beta.3",
"4.3.beta.2",
"4.3.beta.1",
"4.2.12",
"4.2.12.rc.2",
"4.2.12.rc.1",
"4.2.11",
"4.2.11.rc.1",
"4.2.10",
"4.2.9",
"4.2.8",
"4.2.7",
"4.2.6.1",
"4.2.6",
"4.2.6.rc.1",
"4.2.5.3",
"4.2.5.2",
"4.2.5.1",
"4.2.5.1.beta.1",
"4.2.5",
"4.2.4.2",
"4.2.4.1",
"4.2.4",
"4.2.4.rc.3",
"4.2.4.rc.2",
"4.2.3.2",
"4.2.3.1",
"4.2.3",
"4.2.3.rc.1",
"4.2.2.2.rc.1",
"4.2.2.1.rc.1",
"4.2.2.1",
"4.2.2",
"4.2.1",
"4.2",
"4.1.3.2.beta.1",
"4.1.3.1",
"4.1.3",
"4.1.2.1",
"4.1.2",
"4.1.2.rc.1",
"4.1.1.2",
"4.1.1.1",
"4.1.1",
"4.1.1.rc.1",
"4.1.0.1",
"4.1",
"4.0.2",
"4.0.1",
"4.0",
"4.0.rc.4",
"4.0.rc.3",
"4.0.rc.2",
"4.0.rc.1",
"4.0.beta.5",
"4.0.beta.4",
"4.0.beta.3",
"4.0.beta.2",
"4.0.beta.1",
"4.0.alpha.5",
"4.0.alpha.4",
"4.0.alpha.3",
"4.0.alpha.2",
"4.0.alpha.1",
"3.7.5.beta.2",
"3.7.5.beta.1",
"3.7.4.1",
"3.7.4",
"3.7.4.rc.2",
"3.7.4.rc.1",
"3.7.3.6",
"3.7.3.5",
"3.7.3.4",
"3.7.3.3",
"3.7.3.2",
"3.7.3.1",
"3.7.3",
"3.7.3.beta.1",
"3.7.2",
"3.7.1",
"3.7.0.2",
"3.7.0.1.beta.1",
"3.7.0.1",
"3.7",
"3.7.beta.6",
"3.7.beta.5",
"3.7.beta.4",
"3.7.beta.3",
"3.7.beta.2",
"3.7.beta.1",
"3.6.1.1.alpha.3",
"3.6.1.1.alpha.2",
"3.6.1.1.alpha.1",
"3.6.1",
"3.6.0.2.beta.2",
"3.6.0.2.beta.1",
"3.6.0.1",
"3.6",
"3.6.beta.1",
"3.5.2.beta.3",
"3.5.2.beta.2",
"3.5.2.beta.1",
"3.5.1.1",
"3.5.1",
"3.5.0.1",
"3.5",
"3.4.4.1",
"3.4.4",
"3.4.3.2",
"3.4.3.1.beta.2",
"3.4.3.1",
"3.4.3.1.beta.1",
"3.4.3",
"3.0.rc.8",
"2.7.11.10",
"3.0.rc.7",
"3.0.rc.6",
"3.0.rc.5",
"3.0.rc.4",
"3.0.rc.3",
"3.0.beta.1",
"3.0.rc.2",
"3.0.rc.1",
"2.7.11.9",
"2.7.11.8",
"2.7.11.7",
"2.7.11.6",
"2.7.11.5",
"2.7.11.4",
"2.7.11.3",
"2.7.11.2",
"2.7.11.1",
"2.7.11",
"2.7.10.3",
"2.7.10.2",
"2.7.10.1",
"2.7.8.5",
"2.7.8.4",
"2.7.8.3",
"2.7.8.2",
"2.7.8.1",
"2.7.8",
"2.7.7.9",
"2.7.7.7",
"2.7.7.6",
"2.7.7.5",
"2.7.7.3",
"2.7.7.2",
"2.7.7.1",
"2.7.7",
"2.7.6.3",
"2.7.6.2",
"2.7.6.1",
"2.7.6",
"2.7.6.beta.1",
"2.7.5.2",
"2.7.5.1",
"2.7.5",
"2.7.4.3",
"2.7.4.2",
"2.7.4.1",
"2.7.4",
"2.7.4.beta.1",
"2.7.3.1",
"2.7.3",
"2.7.2.1",
"2.7.2",
"2.7.1.1",
"2.7.1",
"2.7",
"2.7.beta.1",
"2.6.3.10",
"2.6.3.9",
"2.6.3.8",
"2.6.3.7",
"2.6.3.6",
"2.6.3.5",
"2.6.3.4",
"2.6.3.3",
"2.6.3.2",
"2.6.3.1",
"2.6.3",
"2.6.2.11",
"2.6.2.9",
"2.6.2.8",
"2.6.beta.3",
"2.6.beta.2",
"2.6.beta.1",
"2.5.7.9",
"2.5.7.8",
"2.5.7.7",
"2.5.7.6",
"2.5.7.5",
"2.5.7.4",
"2.5.7.3",
"2.5.7.2",
"2.5.7.1",
"2.5.7",
"2.5.6",
"2.5.5",
"2.5.5.beta.7",
"2.5.5.beta.6",
"2.5.5.beta.5",
"2.5.5.beta.4",
"2.5.5.beta.3",
"2.5.5.beta.2",
"2.5.4.2",
"2.5.4.1",
"2.5.4",
"2.5.3",
"2.5.2",
"2.5.1.3",
"2.5.1.2",
"2.5.1.1",
"2.5.1",
"2.5",
"2.5.beta.4",
"2.5.beta.3",
"2.5.beta.2",
"2.5.beta.1",
"2.4.7.5",
"2.4.7.4",
"2.4.7.3",
"2.4.7.2",
"2.4.7.1",
"2.4.7",
"2.4.6.2",
"2.4.6.1",
"2.4.6",
"2.4.6.dev.6",
"2.4.6.dev.5",
"2.4.6.dev.4",
"2.4.6.dev.3",
"2.4.6.dev.2",
"2.4.6.dev",
"2.4.5.5.dev",
"2.4.5.4",
"2.4.5.3",
"2.4.5.2",
"2.4.5.1",
"2.4.5",
"2.4.4.7",
"2.4.4.6",
"2.4.4.5",
"2.4.4.4",
"2.4.4.3",
"2.4.4.2",
"2.4.4.1",
"2.4.4",
"2.4.3",
"2.4.2",
"2.4.1",
"2.4",
"2.3.4.1",
"2.3.4",
"2.3.3",
"2.3.2",
"2.3.1",
"2.3",
"2.2.24",
"2.2.23.4",
"2.2.23.3",
"2.2.32.2",
"2.2.23.1",
"2.2.23",
"2.2.22",
"2.2.21.1",
"2.2.21",
"2.2.20",
"2.2.19.5",
"2.2.19.4",
"2.2.19.3",
"2.2.19.2",
"2.2.19.1",
"2.2.19",
"2.2.18.3",
"2.2.18.2",
"2.2.18.1",
"2.2.18",
"2.2.17.1",
"2.2.16.1",
"2.2.16",
"2.2.16.dev",
"2.2.14",
"2.2.13",
"2.2.12",
"2.2.11",
"2.2.10",
"2.2.9",
"2.2.8",
"2.2.7",
"2.2.6",
"2.2.5",
"2.2.4",
"2.2.3",
"2.2.2",
"2.2.1",
"2.2",
"2.2.beta.2",
"2.1.14.1",
"2.1.14",
"2.1.13.15",
"2.1.13.14",
"2.1.13.12",
"2.1.13.11",
"2.1.11.13.dev",
"2.1.13.10",
"2.1.13.9",
"2.1.13.8",
"2.1.13.7",
"2.1.13.6",
"2.1.13.6.dev",
"2.1.14.dev",
"2.1.13.5",
"2.1.13.4",
"2.1.13.3",
"2.1.13.2",
"2.1.13.1",
"2.1.13",
"2.1.12.9",
"2.1.12.8",
"2.1.12.7",
"2.1.12.6",
"2.1.12.5",
"2.1.12.4",
"2.1.11.1",
"2.1.11",
"2.1.10",
"2.1.9.1",
"2.1.9",
"2.1.8.5",
"2.1.8.4",
"2.1.8.3",
"1.2.8.3",
"2.1.8",
"2.0.9.1",
"1.2.5",
"1.2.4",
"1.2.3",
"1.2.1",
"1.1.4",
"1.1.3",
"1.1.2",
"1.1.1",
"1.1",
"1.0.24",
"1.0.23.1",
"1.0.23",
"1.0.22",
"1.0.21.1",
"1.0.21",
"1.0.20.5",
"1.0.20",
"1.0.19.2",
"1.0.19.1",
"1.0.19",
"1.0.18",
"1.0.14",
"1.0.13",
"1.0.12",
"1.0.11.1",
"1.0.11",
"1.0.9.2",
"1.0.9.1",
"1.0.9",
"1.0.6",
"1.0.5",
"1.0.3",
"1.0.1",
"0.9.1",
"0.9",
"0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109221.json"
}
}
],
"modified": "2026-10-28T02:30:33.810717858Z",
"provider": "osv",
"references": [
"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L575",
"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L602",
"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/background/import-contacts.php#L200",
"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L85",
"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L94",
"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L2872",
"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L8045",
"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/main-roles.php#L583",
"https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/utils/files.php#L323",
"https://plugins.trac.wordpress.org/changeset/3744461/groundhogg/trunk/includes/classes/traits/file-box.php",
"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5100ac-cfe6-4e91-9349-6e8efa850147?source=cve",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109221.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-109221",
"https://github.com/groundhoggwp/groundhogg/commit/e319e4a849bfbb07cccfbac8558ad6bf07a7fdc0"
],
"provider_metadata": {
"cwe_ids": [
"CWE-22"
],
"cna_assigner": "Wordfence",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109221.json"
}
},
"related_cves": [
{
"value": "CVE-2026-109221",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 501135,
"published_at": "2026-10-16T04:27:05.579+00:00"
}