What is the CVSS score of CVE-2026-57389?

CVE-2026-57389 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Groundhogg are affected by CVE-2026-57389?

Groundhogg WordPress CRM plugin versions up to 4.4.1 contain a critical unauthenticated path traversal vulnerability enabling remote attackers to delete arbitrary files, including WordPress…

How to fix or mitigate CVE-2026-57389?

Within 24 hours: Audit all WordPress installations for Groundhogg versions 4.4.1 or earlier; disable the plugin immediately and restrict file-system permissions on wp-config.php and critical WordPress core files to read-only. Within 7 days: Implement web application firewall rules blocking path traversal patterns and directory-escape sequences; establish file integrity monitoring on core WordPress files; begin evaluation of replacement CRM solutions or timeline for Groundhogg's availability of a patched version. Within 30 days: Complete either plugin removal and CRM migration, or confirm plugin patch release and perform full patch deployment; conduct file integrity audit on all affected systems and restore from clean backups if unauthorized deletion is detected.

Groundhogg CVE-2026-57389

EUVD-2026-43462 HIGH

Path Traversal (CWE-22)

2026-07-13 Patchstack

Path Traversal Groundhogg

8.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network path traversal with no user interaction (AV:N/AC:L/PR:N/UI:N); arbitrary file deletion damages integrity (I:H) and availability (A:H), and I treat it as unchanged scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:01 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.6

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adrian Tobey Groundhogg groundhogg allows Path Traversal.This issue affects Groundhogg: from n/a through <= 4.4.1.

AnalysisAI

Path traversal in the Groundhogg WordPress CRM/marketing-automation plugin (versions up to and including 4.4.1) lets remote unauthenticated attackers delete arbitrary files on the server by supplying crafted pathnames that escape the intended directory. Patchstack classifies the concrete impact as arbitrary file deletion, and the CVSS vector (AV:N/PR:N with scope-change and high availability impact) reflects that deleting critical files such as wp-config.php can break or reset the WordPress site. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site running Groundhogg <=4.4.1

Delivery

Send crafted request with '../' traversal path

Exploit

Handler resolves path outside plugin directory

Execution

Delete arbitrary file (e.g. wp-config.php)

Impact

Site availability disrupted / reset

Access

Identify WordPress site running Groundhogg <=4.4.1

Delivery

Send crafted request with '../' traversal path

Exploit

Handler resolves path outside plugin directory

Execution

Delete arbitrary file (e.g. wp-config.php)

Impact

Site availability disrupted / reset

Vulnerability AssessmentAI

Exploitation	No special conditions-remote unauthenticated exploitation against default configurations of Groundhogg <= 4.4.1, per the CVSS vector AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H (score 8.6, High) signals a genuinely low bar: network-reachable, low complexity, no privileges and no user interaction, with a scope change and high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker discovers a WordPress site running Groundhogg <= 4.4.1 and sends a crafted unauthenticated HTTP request to the vulnerable file-handling endpoint with a filename parameter containing directory-traversal sequences (e.g. '../../../wp-config.php'). …
Remediation	Upgrade Groundhogg to a release later than 4.4.1 as soon as the vendor publishes a fixed version; the provided data does not name an exact patched version, so consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-4-1-arbitrary-file-deletion-vulnerability) and the plugin's WordPress.org changelog to confirm the specific build before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Audit all WordPress installations for Groundhogg versions 4.4.1 or earlier; disable the plugin immediately and restrict file-system permissions on wp-config.php and critical WordPress core files to read-only. …

Threat intelligence, references, and detailed analysis are available after sign-in.