CVE-2026-57389

WordPress Groundhogg plugin <= 4.4.1 - Arbitrary File Deletion vulnerability

View on CVE.org
Published Jul 13, 2026 CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adrian Tobey Groundhogg groundhogg allows Path Traversal.This issue affects Groundhogg: from n/a through <= 4.4.1.

Analysis

AI-generated

Technical impact

The vulnerability is an improper limitation of a pathname to a restricted directory, allowing an attacker to traverse directories and delete arbitrary files. The flaw can be used to remove files from the web server, destroying critical data, disrupting service, and potentially exposing sensitive information. The associated weakness is Path Traversal (CWE‑22).

Affected Systems

Vendor Adrian Tobey’s Groundhogg WordPress plugin is affected, from its initial release through version 4.4.1. Any site running the plugin on or before that version is potentially vulnerable.

Risk and Exploitability

With a CVSS score of 8.6, the defect represents high severity and the EPSS score indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be remote, file deletion.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Groundhogg plugin to a version newer than 4.4.1, applying the vendor’s official release or patch.
  • If an immediate upgrade is not possible, temporarily disable the plugin or block its file‑deletion endpoint to prevent exploitation.
  • Configure server‑side path validation or deny unknown file‑system traversal attempts by updating web‑application firewall rules and monitoring access logs for suspicious directory‑traversal patterns.

Generated by OpenCVE AI on July 31, 2026 at 12:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Adrian Tobey
Adrian Tobey groundhogg
Wordpress
Wordpress wordpress
Vendors & Products Adrian Tobey
Adrian Tobey groundhogg
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adrian Tobey Groundhogg groundhogg allows Path Traversal.This issue affects Groundhogg: from n/a through <= 4.4.1.
Title WordPress Groundhogg plugin <= 4.4.1 - Arbitrary File Deletion vulnerability
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Jul 13, 2026, 4:07 PM
Reserved
Jun 24, 2026, 12:46 PM

View source JSON

Updated
Jul 13, 2026, 4:02 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 10:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 12:15 PM

JSON