The vulnerability in the Groundhogg WordPress plugin is an Unrestricted Upload of File with Dangerous Type, which permits uploading files such as web shells to the web server. This flaw, identified as CWE‑434, can lead to remote code execution if the attacker can place a malicious script on the server that is later interpreted by the application or the web server.

Affected versions include all releases of the Groundhogg plugin up to and including 4.2.1, distributed by Adrian Tobey. The vulnerability exists in the plugin’s file upload functionality, allowing users to upload arbitrary files without proper type validation.

With a CVSS score of 9.1 the flaw is high severity, though the EPSS score is under 1 % and it is not listed in CISA’s KEV catalog. Attackers would need to interact with the plugin’s upload interface, which is likely accessible only to authenticated users; based on the description it is inferred that the upload is restricted to authenticated users, but the low probability of exploitation is offset by the potential for total compromise once a web shell is in place.