CVE-2026-40727: WordPress Groundhogg plugin <= 4.4 - Arbitrary File Deletion vulnerability

Synopsis

An arbitrary file deletion vulnerability affects the Groundhogg WordPress plugin at version 4.4 and below. It is reachable over the network by any authenticated user holding a Sales Representative role, with no additional interaction required, and carries a scope-changing impact that can disrupt the hosting environment beyond the plugin itself. Successful exploitation allows an attacker to delete arbitrary files on the server, which can corrupt the application, destroy data, or take down the site entirely. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as the upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress instance via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege account with the Sales Representative role is sufficient; no administrator credentials are needed.

• Victim interactionNot required

  No action by another user or administrator is needed to complete the attack.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental timing.

Blast Radius

• Deletes arbitrary files on the web server, including WordPress core files, plugin files, or uploaded content.
• Corrupts the application to the point of a complete site outage, affecting all visitors and authenticated users.
• The scope-changed impact (S:C) means file deletion can reach beyond the WordPress installation itself, potentially affecting other applications or services sharing the same filesystem.
• Deleted configuration or credential files may expose sensitive data stored in those files or enable follow-on attacks.