Groundhogg CVE-2026-109221

Requires an authenticated WordPress user holding the plugin-defined import_contacts capability - granted by default to Groundhogg's custom Sales Representative role - so any Sales Representative or higher qualifies. The flaw is reachable through the contact-import (CSV), REST API, and webhook code paths that call copy_file, where a request-supplied value is wrongly accepted as naming an existing local file. Exploitation requires Groundhogg 4.9.3 or earlier to be installed and active, and the attacker must know or guess the absolute path of a sensitive target file (e.g. wp-config.php) for maximum impact. The limiting factors are the privilege requirement (not anonymous) and the need for that capability to be assigned; there is no user-interaction or non-default-configuration requirement since the Sales Representative role grants the capability by default.

This is a credible, actionable priority rather than an inflated high-CVSS issue, but it is bounded by an authentication requirement. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, 8.1 High) is internally consistent and well-supported by the description: network-reachable, low-complexity, no user interaction, with high integrity and availability impact from arbitrary file deletion and no confidentiality impact (deletion discloses nothing). The one signal to weigh carefully is PR:L - exploitation is not open to anonymous internet users; it requires a user holding the plugin-defined import_contacts capability, which is granted by default to Groundhogg's custom Sales Representative role. That makes the realistic threat model a lower-privileged insider, a compromised sales/marketing account, or a mass-assignment/privilege scenario, rather than fully unauthenticated mass exploitation. The impact ceiling is severe: deleting wp-config.php can push WordPress into setup/installer mode and is a well-understood path to full remote code execution and site takeover. No EPSS score, KEV listing, or public POC is present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis' - the urgency here is driven by impact severity and the clarity of the vendor-confirmed root cause, not by observed in-the-wild activity. No key signals conflict with the description; the main caveat is simply the absence of exploitation-probability telemetry (EPSS) to gauge likelihood.

An attacker who controls a Sales Representative account (or any account granted the import_contacts capability) submits a contact import, REST API call, or webhook whose file field names an absolute server path such as the WordPress wp-config.php. The vulnerable copy_file logic treats the request-supplied value as an existing local file; the subsequent sideload rejection or move then deletes the original, destroying the targeted file. Deleting wp-config.php forces WordPress into an uninitialized/installer state that can be leveraged toward remote code execution and full site takeover; no public exploit code is identified in the provided data.