What is the CVSS score of CVE-2026-57389?

CVE-2026-57389 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Groundhogg are affected by CVE-2026-57389?

Groundhogg WordPress CRM plugin versions up to 4.4.1 contain a critical unauthenticated path traversal vulnerability enabling remote attackers to delete arbitrary files, including WordPress…

How to fix or mitigate CVE-2026-57389?

Within 24 hours: Audit all WordPress installations for Groundhogg versions 4.4.1 or earlier; disable the plugin immediately and restrict file-system permissions on wp-config.php and critical WordPress core files to read-only. Within 7 days: Implement web application firewall rules blocking path traversal patterns and directory-escape sequences; establish file integrity monitoring on core WordPress files; begin evaluation of replacement CRM solutions or timeline for Groundhogg's availability of a patched version. Within 30 days: Complete either plugin removal and CRM migration, or confirm plugin patch release and perform full patch deployment; conduct file integrity audit on all affected systems and restore from clean backups if unauthorized deletion is detected.

Groundhogg CVE-2026-57389

EUVD-2026-43462 HIGH

Path Traversal (CWE-22)

2026-07-13 Patchstack

WordPress Path Traversal Groundhogg Wordpress Plugin

8.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network path traversal with no user interaction (AV:N/AC:L/PR:N/UI:N); arbitrary file deletion damages integrity (I:H) and availability (A:H), and I treat it as unchanged scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:01 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.6

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adrian Tobey Groundhogg groundhogg allows Path Traversal.This issue affects Groundhogg: from n/a through <= 4.4.1.

AnalysisAI

Path traversal in the Groundhogg WordPress CRM/marketing-automation plugin (versions up to and including 4.4.1) lets remote unauthenticated attackers delete arbitrary files on the server by supplying crafted pathnames that escape the intended directory. Patchstack classifies the concrete impact as arbitrary file deletion, and the CVSS vector (AV:N/PR:N with scope-change and high availability impact) reflects that deleting critical files such as wp-config.php can break or reset the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Groundhogg is a self-hosted CRM, email-marketing and sales-automation plugin for WordPress, typically exposing AJAX/REST handlers to the web server (PHP). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): a user-controlled filename or path parameter is passed to a filesystem operation-here a delete/unlink routine-without canonicalizing or constraining it to an allowed base directory, so sequences like '../' let the request reference files outside the plugin's storage area. The affected CPE is cpe:2.3:a:adrian_tobey:groundhogg:*, and Patchstack's advisory identifies the operation as arbitrary file deletion rather than read/write.

RemediationAI

Upgrade Groundhogg to a release later than 4.4.1 as soon as the vendor publishes a fixed version; the provided data does not name an exact patched version, so consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-4-1-arbitrary-file-deletion-vulnerability) and the plugin's WordPress.org changelog to confirm the specific build before deploying. Until a patched version is confirmed, apply compensating controls: use a WAF (such as Patchstack's virtual patch) to block requests containing '../' or encoded traversal sequences to Groundhogg AJAX/REST endpoints; restrict access to the plugin's admin-ajax and REST routes at the reverse proxy where feasible-noting this may disable legitimate front-end forms or automation callbacks; enforce least-privilege filesystem permissions so the PHP/web-server user cannot delete core files like wp-config.php or the uploads directory, accepting that some plugin write operations may fail; and back up the site so a successful deletion can be recovered. Deactivating the plugin fully removes exposure but disables all CRM/marketing functionality.