WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion

The primary impact of CVE-2025-4206 is the potential for remote code execution. An authenticated administrator can leverage this vulnerability to delete critical files, such as wp-config.php, which contains sensitive database credentials and configuration settings. Deletion of this file would effectively disable the WordPress site and allow an attacker to potentially gain control of the server. The ability to delete arbitrary files also opens the door to other malicious activities, including data exfiltration and system compromise. This vulnerability shares similarities with other file deletion vulnerabilities where the deletion of key configuration files can lead to complete system takeover.

Websites utilizing Groundhogg plugin versions 0.0.0 through 4.1.1.2 are at risk, particularly those with administrator accounts that have weak passwords or have been compromised. Shared hosting environments where WordPress installations share resources and user permissions are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r 'process_export_delete' /var/www/html/wp-content/plugins/groundhogg/

• wordpress / composer / npm:

wp plugin list --status=active | grep groundhogg

• wordpress / composer / npm:

curl -I https://your-wordpress-site.com/wp-content/plugins/groundhogg/ | grep -i 'process_export_delete'

1. 2025-05-09Disclosure

   disclosure

1. Reserviert2025-05-01
2. Veröffentlicht2025-05-09
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The immediate mitigation for CVE-2025-4206 is to upgrade Groundhogg to a patched version as soon as it becomes available. If upgrading is not immediately feasible, restrict administrator access to the plugin's export and import functionalities. Implement a Web Application Firewall (WAF) rule to block requests to the processexportdelete and processimportdelete endpoints. Regularly review file permissions on the WordPress installation to ensure that only authorized users have write access to sensitive files. Monitor WordPress logs for suspicious file deletion attempts. After upgrading, confirm the fix by attempting to access the vulnerable endpoints with an administrator account and verifying that file deletion is prevented.

Aktive Installationen

2KBeliebt

Plugin-Bewertung