CVE-2025-4206highCWE-22

CVE-2025-4206: fallo de gravedad alta en trainingbusinesspros Groundhogg — CRM…

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Groundhogg — CRM, Newsletters, and Marketing Automation

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.2epss 1.6%
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'process_export_delete' and 'process_import_delete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation
CVEs relacionadas — trainingbusinesspros Groundhogg — CRM…

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-0394HIGHGroundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload FunctionEPSS 1.2%CVE-2026-109221HIGHGroundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field MappingEPSS 0.8%CVE-2026-18387MEDIUMGroundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' ParameterEPSS 0.7%CVE-2026-13333MEDIUMGroundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' ParameterEPSS 0.6%CVE-2023-2715MEDIUMGroundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket CreationEPSS 0.6%CVE-2026-14029MEDIUMGroundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' ParameterEPSS 0.6%