Skip to main content

Groundhogg CVE-2026-85310

| EUVDEUVD-2026-75510 MEDIUM
Path Traversal: '.../...//' (CWE-35)
2026-09-10 Patchstack GHSA-7967-6mvr-9g9g
WordPress Path Traversal Groundhogg Wordpress Plugin
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
6.5 MEDIUM

Network-exploitable with low-privilege WordPress account required; read-only arbitrary file access yields high confidentiality impact but no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Sep 10, 2026 - 15:06 vuln.today
CVE Published
Sep 10, 2026 - 14:23 cve.org
MEDIUM 6.5

DescriptionCVE.org

import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.

AnalysisAI

Path traversal in the import_contacts function of the Groundhogg WordPress CRM plugin (versions ≤ 4.7.1) allows authenticated low-privilege users to read arbitrary files from the web server by supplying directory traversal sequences in a file path parameter. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the flaw is network-exploitable with no complexity or interaction requirements beyond holding a basic WordPress account. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid WordPress user account with at least low-level privileges - subscriber or contributor role is sufficient, as indicated by PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 6.5 Medium rating is justified by the PR:L constraint - a valid WordPress account is required - but the practical impact ceiling is higher than the score implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update the Groundhogg plugin to the version released after 4.7.1 - the exact patched release number should be verified at the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-7-1-path-traversal-vulnerability) or the WordPress.org plugin changelog, as the specific fix version is not independently confirmed in the provided intelligence. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Groundhogg

View all
CVE-2019-15647 HIGH POC
8.8 Aug 27

The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code exe
CVE-2023-1425 HIGH POC
7.2 Apr 10

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner - Groundhogg WordPress plugin before 2.7.9.
CVE-2023-2111 MEDIUM POC
4.9 May 30

The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL quer
CVE-2026-57389 HIGH
8.6 Jul 13

Path traversal in the Groundhogg WordPress CRM/marketing-automation plugin (versions up to and including 4.4.1) lets rem
CVE-2026-40727 HIGH
7.7 Jun 15

Arbitrary file deletion in the Groundhogg WordPress plugin (versions 4.4 and earlier) allows authenticated users with th
CVE-2023-34179 HIGH
7.6 Nov 03

A vulnerability in Adrian Tobey Groundhogg groundhogg.7.11. Rated high severity (CVSS 7.6), this vulnerability is remote
CVE-2023-2736 HIGH
7.5 May 20

The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.
CVE-2026-48885 HIGH
7.1 Jun 15

Unauthenticated reflected/stored cross-site scripting in the HollerBox WordPress plugin (versions 2.3.10.1 and earlier)

CVE-2026-40793 MEDIUM
6.5 Jun 15

Broken access control in the Groundhogg WordPress CRM/marketing automation plugin (all versions below 4.4.1) allows low-
CVE-2024-37264 MEDIUM
6.1 Jul 22

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Groundhogg

CVE-2023-2716 MEDIUM
5.4 May 20

The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missi
CVE-2023-34178 MEDIUM
5.4 Nov 09

A vulnerability in Adrian Tobey Groundhogg groundhogg.7.11. Rated medium severity (CVSS 5.4), this vulnerability is remo

Same weakness CWE-35 – Path Traversal: '.../...//'

View all
CVE-2025-8088 HIGH POC
8.4
CVE-2024-2863 CRITICAL POC
9.8
CVE-2018-3744 CRITICAL POC
9.8
CVE-2024-36991 HIGH POC
7.5
CVE-2026-6074 CRITICAL
9.3
CVE-2026-59115 CRITICAL
9.9
CVE-2026-69109 HIGH
8.7
CVE-2024-45190 MEDIUM POC
6.5

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

CVE-2026-85310 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy