{"metadata": {"vulnerability": "CVE-2026-109221", "count": 16, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-12T13:45:12.260Z", "date_only": false, "value": "2026-10-12T13:45:12.260Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109221", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T14:00:07Z", "date_only": false, "value": "2026-10-12T14:00:07.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109221", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-15T15:47:51Z", "date_only": false, "value": "2026-10-15T15:47:51.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109221", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T04:27:05.579Z", "date_only": false, "value": "2026-10-16T04:27:05.579Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109221", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T04:27:05.579Z", "date_only": false, "value": "2026-10-16T04:27:05.579Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109221", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T04:49:06.968Z", "date_only": false, "value": "2026-10-16T04:49:06.968535Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117448779136740643", "record": "CVE-2026-109221", "field": "creation_timestamp", "uuid": "77d8efc9-6beb-478d-a7ea-65bb99a08067", "content": "CVE-2026-109221 Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109221https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5100ac-cfe6-4e91-9349-6e8efa850147?source=cvehttps://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L94https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L85https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/utils/files.php#L323https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L2872https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L8045https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/background/import-contacts.php#L200https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L575https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L602https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/main-roles.php#L583https://github.com/groundhoggwp/groundhogg/commit/e319e4a849bfbb07cccfbac8558ad6bf07a7fdc0https://plugins.trac.wordpress.org/changeset/3744461/groundhogg/trunk/includes/classes/traits/file-box.php#wordpress #trainingbusinesspros #Groundhogg\u2014CRM,Newsletters,andMarketingAutomation#CVE_2026_109221#bot", "url": "https://infosec.exchange/users/cve/statuses/117448779136740643"}, {"timestamp": "2026-10-16T05:17:29Z", "date_only": false, "value": "2026-10-16T05:17:29Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XQ4H-VHG9-4X8M", "record": "GHSA-XQ4H-VHG9-4X8M", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T05:17:29.227Z", "date_only": false, "value": "2026-10-16T05:17:29.227", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109221", "record": "FKIE_CVE-2026-109221", "field": "published"}, {"timestamp": "2026-10-16T06:11:17.654Z", "date_only": false, "value": "2026-10-16T06:11:17.654166Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/dmp3kzqgtygsy", "record": "CVE-2026-109221", "field": "creation_timestamp", "uuid": "65cdf0f3-5cca-4248-a0d0-d22f474b2d53", "content": "CVE-2026-109221 - Groundhogg\nCVE ID : CVE-2026-109221\n \n Published : Oct. 16, 2026, 5:17 a.m. | 16\u00a0minutes ago\n \n Description : The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file pa...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/dmp3kzqgtygsy"}, {"timestamp": "2026-10-16T06:30:26Z", "date_only": false, "value": "2026-10-16T06:30:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XQ4H-VHG9-4X8M", "record": "GHSA-XQ4H-VHG9-4X8M", "field": "published"}, {"timestamp": "2026-10-16T06:30:26Z", "date_only": false, "value": "2026-10-16T06:30:26Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XQ4H-VHG9-4X8M", "record": "GHSA-XQ4H-VHG9-4X8M", "field": "modified"}, {"timestamp": "2026-10-16T16:31:58.151Z", "date_only": false, "value": "2026-10-16T16:31:58.151047Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109221", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T16:31:58.151Z", "date_only": false, "value": "2026-10-16T16:31:58.151047Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109221", "record": "FKIE_CVE-2026-109221", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T17:07:01.282Z", "date_only": false, "value": "2026-10-16T17:07:01.282Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109221", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T17:07:01.282Z", "date_only": false, "value": "2026-10-16T17:07:01.282Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109221", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:17:30.680Z", "date_only": false, "value": "2026-10-16T18:17:30.680", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109221", "record": "FKIE_CVE-2026-109221", "field": "lastModified"}]}