CVE-2026-109221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109221
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109221.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109221
Published
2026-10-16T04:27:05Z
Modified
2026-10-17T02:48:00Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
Details

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.

Database specific 
{
    "cna_assigner":  "Wordfence",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109221.json"
}
References

Affected packages

Git / github.com/groundhoggwp/groundhogg

Affected ranges

Type
GIT
Repo
https://github.com/groundhoggwp/groundhogg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e319e4a849bfbb07cccfbac8558ad6bf07a7fdc0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "4.9.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1
0.9
0.9.1
1.*
1.0.1
1.0.11
1.0.11.1
1.0.12
1.0.13
1.0.14
1.0.18
1.0.19
1.0.19.1
1.0.19.2
1.0.20
1.0.20.5
1.0.21
1.0.21.1
1.0.22
1.0.23
1.0.23.1
1.0.24
1.0.3
1.0.5
1.0.6
1.0.9
1.0.9.1
1.0.9.2
1.1
1.1.1
1.1.2
1.1.3
1.1.4
1.2.1
1.2.3
1.2.4
1.2.5
1.2.8.3
2.*
2.0.9.1
2.1.10
2.1.11
2.1.11.1
2.1.11.13.dev
2.1.12.4
2.1.12.5
2.1.12.6
2.1.12.7
2.1.12.8
2.1.12.9
2.1.13
2.1.13.1
2.1.13.10
2.1.13.11
2.1.13.12
2.1.13.14
2.1.13.15
2.1.13.2
2.1.13.3
2.1.13.4
2.1.13.5
2.1.13.6
2.1.13.6.dev
2.1.13.7
2.1.13.8
2.1.13.9
2.1.14
2.1.14.1
2.1.14.dev
2.1.8
2.1.8.3
2.1.8.4
2.1.8.5
2.1.9
2.1.9.1
2.2
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.16
2.2.16.1
2.2.16.dev
2.2.17.1
2.2.18
2.2.18.1
2.2.18.2
2.2.18.3
2.2.19
2.2.19.1
2.2.19.2
2.2.19.3
2.2.19.4
2.2.19.5
2.2.2
2.2.20
2.2.21
2.2.21.1
2.2.22
2.2.23
2.2.23.1
2.2.23.3
2.2.23.4
2.2.24
2.2.3
2.2.32.2
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.beta.2
2.3
2.3.1
2.3.2
2.3.3
2.3.4
2.3.4.1
2.4
2.4.1
2.4.2
2.4.3
2.4.4
2.4.4.1
2.4.4.2
2.4.4.3
2.4.4.4
2.4.4.5
2.4.4.6
2.4.4.7
2.4.5
2.4.5.1
2.4.5.2
2.4.5.3
2.4.5.4
2.4.5.5.dev
2.4.6
2.4.6.1
2.4.6.2
2.4.6.dev
2.4.6.dev.2
2.4.6.dev.3
2.4.6.dev.4
2.4.6.dev.5
2.4.6.dev.6
2.4.7
2.4.7.1
2.4.7.2
2.4.7.3
2.4.7.4
2.4.7.5
2.5
2.5.1
2.5.1.1
2.5.1.2
2.5.1.3
2.5.2
2.5.3
2.5.4
2.5.4.1
2.5.4.2
2.5.5
2.5.5.beta.2
2.5.5.beta.3
2.5.5.beta.4
2.5.5.beta.5
2.5.5.beta.6
2.5.5.beta.7
2.5.6
2.5.7
2.5.7.1
2.5.7.2
2.5.7.3
2.5.7.4
2.5.7.5
2.5.7.6
2.5.7.7
2.5.7.8
2.5.7.9
2.5.beta.1
2.5.beta.2
2.5.beta.3
2.5.beta.4
2.6.2.11
2.6.2.8
2.6.2.9
2.6.3
2.6.3.1
2.6.3.10
2.6.3.2
2.6.3.3
2.6.3.4
2.6.3.5
2.6.3.6
2.6.3.7
2.6.3.8
2.6.3.9
2.6.beta.1
2.6.beta.2
2.6.beta.3
2.7
2.7.1
2.7.1.1
2.7.10.1
2.7.10.2
2.7.10.3
2.7.11
2.7.11.1
2.7.11.10
2.7.11.2
2.7.11.3
2.7.11.4
2.7.11.5
2.7.11.6
2.7.11.7
2.7.11.8
2.7.11.9
2.7.2
2.7.2.1
2.7.3
2.7.3.1
2.7.4
2.7.4.1
2.7.4.2
2.7.4.3
2.7.4.beta.1
2.7.5
2.7.5.1
2.7.5.2
2.7.6
2.7.6.1
2.7.6.2
2.7.6.3
2.7.6.beta.1
2.7.7
2.7.7.1
2.7.7.2
2.7.7.3
2.7.7.5
2.7.7.6
2.7.7.7
2.7.7.9
2.7.8
2.7.8.1
2.7.8.2
2.7.8.3
2.7.8.4
2.7.8.5
2.7.beta.1
3.*
3.0.beta.1
3.0.rc.1
3.0.rc.2
3.0.rc.3
3.0.rc.4
3.0.rc.5
3.0.rc.6
3.0.rc.7
3.0.rc.8
3.4.3
3.4.3.1
3.4.3.1.beta.1
3.4.3.1.beta.2
3.4.3.2
3.4.4
3.4.4.1
3.5
3.5.0.1
3.5.1
3.5.1.1
3.5.2.beta.1
3.5.2.beta.2
3.5.2.beta.3
3.6
3.6.0.1
3.6.0.2.beta.1
3.6.0.2.beta.2
3.6.1
3.6.1.1.alpha.1
3.6.1.1.alpha.2
3.6.1.1.alpha.3
3.6.beta.1
3.7
3.7.0.1
3.7.0.1.beta.1
3.7.0.2
3.7.1
3.7.2
3.7.3
3.7.3.1
3.7.3.2
3.7.3.3
3.7.3.4
3.7.3.5
3.7.3.6
3.7.3.beta.1
3.7.4
3.7.4.1
3.7.4.rc.1
3.7.4.rc.2
3.7.5.beta.1
3.7.5.beta.2
3.7.beta.1
3.7.beta.2
3.7.beta.3
3.7.beta.4
3.7.beta.5
3.7.beta.6
4.*
4.0
4.0.1
4.0.2
4.0.alpha.1
4.0.alpha.2
4.0.alpha.3
4.0.alpha.4
4.0.alpha.5
4.0.beta.1
4.0.beta.2
4.0.beta.3
4.0.beta.4
4.0.beta.5
4.0.rc.1
4.0.rc.2
4.0.rc.3
4.0.rc.4
4.1
4.1.0.1
4.1.1
4.1.1.1
4.1.1.2
4.1.1.rc.1
4.1.2
4.1.2.1
4.1.2.rc.1
4.1.3
4.1.3.1
4.1.3.2.beta.1
4.2
4.2.1
4.2.10
4.2.11
4.2.11.rc.1
4.2.12
4.2.12.rc.1
4.2.12.rc.2
4.2.2
4.2.2.1
4.2.2.1.rc.1
4.2.2.2.rc.1
4.2.3
4.2.3.1
4.2.3.2
4.2.3.rc.1
4.2.4
4.2.4.1
4.2.4.2
4.2.4.rc.2
4.2.4.rc.3
4.2.5
4.2.5.1
4.2.5.1.beta.1
4.2.5.2
4.2.5.3
4.2.6
4.2.6.1
4.2.6.rc.1
4.2.7
4.2.8
4.2.9
4.3
4.3.1
4.3.1.beta.1
4.3.2
4.3.3
4.3.3.rc.1
4.3.beta.1
4.3.beta.2
4.3.beta.3
4.3.rc.1
4.4
4.4.1
4.4.2
4.5
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.15
4.5.15.beta.1
4.5.15.beta.2
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.5.dev.1
4.5.dev.2
4.6
4.6.1
4.6.beta.1
4.7
4.7.1
4.7.2
4.7.2.beta.1
4.8
4.8.1
4.8.2
4.8.3
4.9
4.9.1
4.9.2
4.9.2.rc.1
4.9.3
4.9.rc.1
4.9.rc.2
4.9.rc.3
4.9.rc.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109221.json"