CVE-2026-109221: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation

CVE-2026-109221 is a path traversal vulnerability (CWE-22) in the Groundhogg WordPress plugin up to version 4.9.3. The flaw exists in the copy_file function due to improper limitation of pathname to a restricted directory, allowing authenticated attackers with the import_contacts capability (granted by default to the Sales Representative role) to delete arbitrary files on the server. This can escalate to remote code execution by deleting key files like wp-config.php.

An attacker with at least Sales Representative-level privileges can delete arbitrary files on the server hosting the WordPress site. This can disrupt service availability and potentially lead to remote code execution if critical configuration files are removed. The vulnerability does not require user interaction and has a low attack complexity, making it a significant risk in affected environments.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or review user roles and capabilities to limit access to the import_contacts capability, especially for untrusted users.