The Groundhogg WordPress plugin, in all versions up to and including 4.1.1.2, contains insufficient validation of file paths within the 'process_export_delete' and 'process_import_delete' functions. This vulnerability allows authenticated administrators to delete any file on the server by manipulating the file path parameter. Because critical files such as wp-config.php can be removed, an attacker could compromise the site and gain remote code execution. The weakness is a path traversal (CWE‑22) that directly affects the integrity of the site’s file system.

The Groundhogg plugin for WordPress, provided by trainingbusinesspros, is affected in all releases up to 4.1.1.2. Administrators or higher‑privileged roles in a WordPress installation using this plugin are at risk.

The CVSS score of 7.2 indicates high severity, and the EPSS of 6% suggests a non‑negligible exploitation probability today. The vulnerability is not listed in the CISA KEV catalog, but its impact is significant because it permits deletion of arbitrary files, potentially leading to remote code execution. Inferred from the description, the likely attack vector is a web‑based request sent from an authenticated administrator’s session to the export/import deletion endpoints.