The vulnerability occurs in the Groundhogg plugin for WordPress, where the copy_file function fails to properly validate file paths during CSV import. This omission allows any authenticated user with the import_contacts capability – granted to Sales Representatives and higher – to delete arbitrary files on the server. Deleting essential files such as wp‑config.php can immediately lead to remote code execution or other severe compromises. This flaw is a classic example of path traversal (CWE‑22) resulting in a loss of confidentiality, integrity, and availability of the site.

The affected product is the Groundhogg CRM, Newsletters, and Marketing Automation plugin, versions up to and including 4.9.3, provided by trainingbusinesspros. Any WordPress site installing this plugin and assigning the import_contacts capability to a Sales Representative or higher role is vulnerable. The flaw exists in the copy_file field mapping used during the CSV import process.

The CVSS vector yields a score of 8.1, marking the issue as severe. The EPSS score is not available, making it unclear how frequently this has been exploited, but the lack of a KEV listing indicates no confirmed exploitation yet. The vulnerability requires authentication and the import_contacts capability, so an attacker must first compromise a user account with at least Sales Representative permissions. Once achieved, they can perform arbitrary deletions by crafting a CSV that sets the copy_file field to a target path; if the file is a critical configuration file, remote code execution can follow.