What is the CVSS score of CVE-2026-40727?

CVE-2026-40727 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Groundhogg are affected by CVE-2026-40727?

The Groundhogg WordPress plugin (versions 4.4 and earlier) contains a file deletion vulnerability exploitable by Sales Representatives, creating an insider threat that can compromise website…

How to fix or mitigate CVE-2026-40727?

Within 24 hours: Audit all users assigned the Sales Representative role in Groundhogg; revoke access for users who don't require it; enable file deletion logging. Within 7 days: Implement Web Application Firewall (WAF) rules to block path traversal attempts; review WordPress file system permissions with principle of least privilege. Within 30 days: Monitor for Groundhogg 4.5+ release with a patched version; plan upgrade path or migrate to alternative CRM platform; deploy file integrity monitoring (FIM) on critical application directories.

Groundhogg CVE-2026-40727

EUVD-2026-36971 HIGH

Path Traversal (CWE-22)

2026-06-15 Patchstack

GHSA-x77p-2pm4-6632

Path Traversal Groundhogg

7.7

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

7.7 HIGH

Network-reachable WordPress endpoint (AV:N), low-complexity traversal (AC:L), requires authenticated Sales Representative role (PR:L), no UI; file deletion escapes plugin scope (S:C) causing availability loss only (A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:15 vuln.today

DescriptionCVE.org

Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.

AnalysisAI

Arbitrary file deletion in the Groundhogg WordPress plugin (versions 4.4 and earlier) allows authenticated users with the Sales Representative role to delete files outside the plugin's intended scope via a path traversal flaw. With no public exploit identified at time of analysis and a CVSS 7.7 driven by scope change and high availability impact, the issue threatens site integrity and uptime rather than data confidentiality. The vulnerability was disclosed by Patchstack and is tracked in the ENISA EUVD as EUVD-2026-36971.

Technical ContextAI

Groundhogg is a CRM and marketing automation plugin for WordPress used to manage contacts, funnels, and email campaigns. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., Path Traversal), indicating that a file path parameter handled by a Sales Representative-accessible endpoint is not properly normalized or constrained, letting '../' sequences escape an intended directory. Because WordPress plugins run inside the web server's PHP process, deletions occur with the privileges of the web user, which typically owns wp-content and other application files. The affected CPE is cpe:2.3:a:groundhogg:groundhogg:*:*:*:*:*:*:*:*, covering all builds up to and including 4.4.

RemediationAI

Upgrade Groundhogg to a version newer than 4.4 once the vendor publishes a fixed release; patch availability is referenced by the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-4-arbitrary-file-deletion-vulnerability), but a specific fixed version is not stated in the supplied data, so consult the plugin changelog before updating. Until the upgrade is applied, audit which accounts hold the Sales Representative role and demote or remove any untrusted users, since this role is the exploitation prerequisite; you may also temporarily disable the Sales Representative role via a role-management plugin, accepting the trade-off that sales staff will lose CRM access. As a filesystem-level compensating control, tighten ownership and permissions on wp-content so the PHP user cannot delete non-plugin files (this can break other plugins that legitimately write to those paths), and consider a WAF rule that blocks request parameters containing '../' or URL-encoded traversal sequences targeting Groundhogg admin-ajax or REST endpoints.