# CVE-2026-40727: Groundhogg arbitrary file deletion in Sales Representative component

Source: https://junglewise.ai/threats/cve-2026-40727-groundhogg-arbitrary-file-deletion-in-sales-representative  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-40727 · Severity: high · CVSS 7.7 · Published 2026-06-15

Groundhogg is a marketing automation and CRM plugin for WordPress. A security flaw allows users with 'Sales Representative' permissions to delete arbitrary files from the web server. This could lead to a complete site failure or service outage if critical system files are removed.

Technologies: [Groundhogg](https://junglewise.ai/threats/technologies/groundhogg). Vendors: [Groundhogg](https://junglewise.ai/threats/vendors/groundhogg).

## Quick answers

**Is CVE-2026-40727 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40727 being exploited in the wild.

**How severe is CVE-2026-40727?** High severity, with a CVSS score of 7.7, published 15 June 2026.

**Which products and versions are affected?** Groundhogg <= 4.4.

**Is there a fix for CVE-2026-40727?** A patch was published on 2026-04-16: Patch released in version 4.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40727 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-40727?** Check whether you run Groundhogg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Groundhogg plugin for WordPress (versions 4.4 and below) contains a path traversal vulnerability (CWE-22) that allows for arbitrary file deletion. The flaw is accessible to authenticated users with the 'Sales Representative' role. By exploiting this, an attacker can send a crafted request to delete sensitive files on the server, including WordPress core files or configuration files. This vulnerability is rated with a CVSS score of 7.7, primarily impacting system availability. A patch is available in version 4.4.1.

## Affected products

- Groundhogg Groundhogg <= 4.4

## Timeline

- 2026-01-06: other: Reported by researcher daroo
- 2026-04-16: patched: Patch released in version 4.4.1
- 2026-06-15: disclosed: CVE published and NVD entry created

## References

- [https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-4-arbitrary-file-deletion-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-4-arbitrary-file-deletion-vulnerability?_s_id=cve)

## Related threats

- [Groundhogg privilege escalation via hardcoded support account identifiers](https://junglewise.ai/threats/cve-2026-92975-the-groundhogg-crm-newsletters-and-marketing-automation-plugin)
- [Groundhogg sensitive data exposure](https://junglewise.ai/threats/cve-2026-104385-unauthenticated-sensitive-data-exposure-in-groundhogg-4-8-3)
- [Groundhogg SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-104408-improper-neutralization-of-special-elements-used-in-an-sql)
- [Groundhogg import_contacts path traversal](https://junglewise.ai/threats/cve-2026-85310-groundhogg-import-contacts-path-traversal)
- [Groundhogg open redirect in email preference confirmation](https://junglewise.ai/threats/cve-2026-81741-groundhogg-open-redirect-in-email-preference-confirmation)