CVE-2025-4206 Path traversal in Groundhogg — CRM, Newsletters, and Marketing Automation
Administrators can delete arbitrary files via path traversal, potentially leading to remote code execution by deleting critical configuration files.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4206?
CVE-2025-4206 is a high-severity path traversal vulnerability in trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation, published on 9 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'process_export_delete' and 'process_import_delete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Weakness: CWE-22
Which versions are affected by CVE-2025-4206?
How do I fix CVE-2025-4206?
No fix has been published for CVE-2025-4206 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-4206 being exploited?
There is no known exploitation of CVE-2025-4206 in the wild and no public exploit code.
Sources
Also known as GHSA-35m2-qpj3-cgx8.