# CVE-2026-57389: Adrian Tobey Groundhogg path traversal arbitrary file deletion

Source: https://junglewise.ai/threats/cve-2026-57389-adrian-tobey-groundhogg-path-traversal-arbitrary-file-deletion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-57389 · Severity: high · CVSS 8.6 · Published 2026-07-13

Groundhogg is a marketing automation and CRM plugin for WordPress. A security flaw in this plugin allows an attacker to delete critical files from the website's server. This can lead to a complete service outage, website defacement, or the removal of security configurations, potentially breaking the site's functionality and impacting business operations.

Technologies: [Groundhogg](https://junglewise.ai/threats/technologies/groundhogg). Vendors: [Groundhogg](https://junglewise.ai/threats/vendors/groundhogg).

## Quick answers

**Is CVE-2026-57389 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57389 being exploited in the wild.

**How severe is CVE-2026-57389?** High severity, with a CVSS score of 8.6, published 13 July 2026.

**Which products and versions are affected?** Groundhogg <= 4.4.1.

**Is there a fix for CVE-2026-57389?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57389 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57389?** Check whether you run Groundhogg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the Groundhogg plugin for WordPress through version 4.4.1. The flaw allows an unauthenticated remote attacker to bypass directory restrictions and delete arbitrary files on the server. By manipulating file path inputs, an attacker can target critical system or application files, leading to a complete denial of service (DoS) as the website or server may cease to function. The vulnerability is addressed in version 4.5.

## Affected products

- Adrian Tobey Groundhogg <= 4.4.1

## Timeline

- 2026-05-25: other: Reported by she11f
- 2026-07-08: advisory: Patchstack advisory published
- 2026-07-13: disclosed: NVD publication date

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-4-1-arbitrary-file-deletion-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-4-1-arbitrary-file-deletion-vulnerability?_s_id=cve)

## Related threats

- [Groundhogg privilege escalation via hardcoded support account identifiers](https://junglewise.ai/threats/cve-2026-92975-the-groundhogg-crm-newsletters-and-marketing-automation-plugin)
- [Groundhogg sensitive data exposure](https://junglewise.ai/threats/cve-2026-104385-unauthenticated-sensitive-data-exposure-in-groundhogg-4-8-3)
- [Groundhogg SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-104408-improper-neutralization-of-special-elements-used-in-an-sql)
- [Groundhogg import_contacts path traversal](https://junglewise.ai/threats/cve-2026-85310-groundhogg-import-contacts-path-traversal)
- [Groundhogg open redirect in email preference confirmation](https://junglewise.ai/threats/cve-2026-81741-groundhogg-open-redirect-in-email-preference-confirmation)