CVE-2026-85310

Executive Summary

CVE-2026-85310 is a path traversal vulnerability (CWE-35) in the import_contacts functionality of the Groundhogg WordPress plugin, affecting versions up to and including 4.7.1. An authenticated attacker with low privileges can manipulate file path input to read files outside the intended directory, resulting in unauthorized disclosure of sensitive server-side data. With a CVSS v3.1 base score of 6.5 and no vendor patch, no public exploit, and no CISA KEV listing, this represents a moderate-severity, high-confidentiality-impact risk that is currently unmitigated by any official fix.

Technical Analysis

Groundhogg is a marketing automation and CRM plugin for WordPress. The vulnerability resides in the plugin's contact import routine, referenced in the NVD description as import_contacts. This routine accepts a file path parameter that is used to locate and read a user-supplied file for import processing. Because the input is not properly canonicalized or constrained to a trusted base directory, an attacker can inject traversal sequences (e.g., ../) to escape the intended import directory and reference arbitrary files on the server filesystem.

The flaw maps to CWE-35 ("Path Traversal: '.../...//'"), a specific variant of path traversal in which the attacker relies on multi-level ../ sequences or path normalization ambiguity to bypass naive filter logic. The defining characteristic of CWE-35 is that simplistic blacklist-based sanitization (e.g., stripping a single ../) can be defeated by alternate or repeated encodings, which is why canonicalization-based validation is the required defense.

Key technical attributes derivable from the provided data:

• Attack vector: Network (AV:N) — the endpoint is reachable over HTTP/S through the WordPress web tier.
• Privileges required: Low (PR:L) — an authenticated account is needed; this is consistent with the import_contacts functionality being an administrative/editorial action rather than an unauthenticated one.
• User interaction: None (UI:N) — the attacker triggers the read directly.
• Scope: Unchanged (S:U) — the vulnerable component and impacted component are the same WordPress application context.
• Confidentiality impact: High (C:H) — arbitrary file read can expose wp-config.php, database credentials, authentication salts, and other secrets.
• Integrity/availability impact: None (I:N/A:N) — the primitive described is read-only file disclosure.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a base score of 6.5 (Medium). No public PoC, exploit code, or Nuclei template is currently available, so the precise endpoint path, parameter name, and any sanitization routine are not confirmed by a public source. The NVD description explicitly names only import_contacts; no internal function names, parameter names, or file paths beyond that identifier should be assumed.

The absence of vendor patch evidence (patch confidence 0/4) and the absence of an affected-version list beyond the <= 4.7.1 range means defenders cannot rely on a version-fixed boundary. Organizations should treat all Groundhogg installations meeting the version criterion as potentially vulnerable until the vendor publishes an advisory.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the CVE metadata provided.

1. Reconnaissance / target identification. The attacker identifies WordPress sites running Groundhogg at a vulnerable version (≤ 4.7.1). Discovery can be performed via Shodan queries against known Groundhogg asset fingerprints, or by probing for the plugin's static assets and readme files on candidate hosts. Sites exposing the plugin's import interface are prioritized.

2. Authentication / access acquisition. Because the CVSS vector specifies PR:L, the attacker requires at least a low-privileged authenticated session. In practice the import capability is typically granted to editor/administrator roles; an attacker would obtain such an account through credential stuffing, phishing, or a separate low-severity privilege path. The flaw itself is triggered from within an authenticated context.

3. Triggering the path traversal. The attacker invokes the import_contacts functionality and supplies a crafted file path in the request. Using ../ sequences (or the multi-level .../...// form characteristic of CWE-35), the attacker directs the routine to resolve a file outside the intended import directory. Because the vulnerable behavior is path resolution against user-controlled input, a naive filter that removes only a single traversal token can be bypassed with repeated or re-encoded sequences.

4. Post-exploitation impact. Successful traversal yields arbitrary file read limited to the web user's filesystem permissions. High-value targets include WordPress configuration files containing database credentials and auth keys, .env files, backup archives, and OS files such as /etc/passwd. The read-only nature (I:N/A:N) means the attacker does not directly modify or delete data through this primitive; however, disclosed secrets frequently enable lateral movement, database access, or authentication bypass in follow-on stages.

Caveat: The exact endpoint, parameter name, and sanitization logic are not disclosed in the available data. The chain above describes the vulnerability class and the mechanism the CWE implies; it does not fabricate specific code patterns or named functions beyond import_contacts.

Impact Assessment

• Confidentiality (High): Arbitrary file read from the web server can expose credentials, secrets, and proprietary configuration, representing the primary and severe impact.
• Integrity / Availability (None): The described primitive is read-only; no direct data modification or denial of service is attributed.
• Blast radius: Every site running Groundhogg ≤ 4.7.1 with the import feature accessible to a low-privileged account is in scope. In shared-hosting environments, file-read access is bounded by the web user's permissions, but credential disclosure often extends impact beyond a single site.
• Business impact: Disclosure of wp-config.php or similar secrets can lead to full database compromise, site takeover, and downstream customer data exposure at marketing/CRM scale. Because Groundhogg stores contact data, downstream privacy obligations (GDPR/CCPA) may be triggered by any confirmed exploitation.
• Exploitability posture: AC:L and UI:N make the vulnerability straightforward to exploit once authenticated access exists. The lack of a public PoC lowers immediate mass-exploitation risk, but the low barriers mean weaponization is plausible.

Detection Guidance

Sigma Rule

title: Potential Groundhogg import_contacts Path Traversal Attempt
id: 8a2f1c4e-8531-4cve-8531-groundhogg-pt
status: experimental
description: Detects path traversal sequences in requests targeting the Groundhogg import_contacts functionality (CVE-2026-85310).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85310
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'GET'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e/'
      - '%2e%2e%2f'
      - '....//'
  selection_target:
    cs-uri-query|contains: 'contacts'
  condition: selection_method and selection_traversal and selection_target
falsepositives:
  - Legitimate administrative import activity referencing relative paths
level: medium
tags:
  - attack.t1190
  - cve.2026.85310

YARA Rule

rule CVE_2026_85310_Groundhogg_Traversal
{
    meta:
        author = "valtersit.com"
        description = "Detects path traversal patterns targeting Groundhogg import_contacts (CVE-2026-85310)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85310"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $fn = "import_contacts" ascii nocase
        $trav1 = "../" ascii
        $trav2 = "..\\" ascii
        $trav3 = "%2e%2e%2f" ascii nocase
        $trav4 = "....//" ascii
        $wpcfg = "wp-config.php" ascii nocase
    condition:
        $fn and 1 of ($trav*) and filesize < 512KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85310 Groundhogg import_contacts Path Traversal Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"contacts"; content:"import"; nocase; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c|\.\.\.\.\/\/)/i"; reference:cve,2026-85310; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85310; classtype:web-application-attack; sid:86085310; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [http where http.request.method in ("GET", "POST")
     and wildcard(http.request.uri.path, "*contacts*")
     and wildcard(http.request.uri.query, "*import*")]
  [http where http.request.method in ("GET", "POST")
     and (wildcard(http.request.uri.query, "*../*")
          or wildcard(http.request.uri.query, "*%2e%2e%2f*")
          or wildcard(http.request.uri.query, "*....//*"))]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
("import_contacts" OR "contacts")
| eval has_traversal=if(match(uri, "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c|\.\.\.\.//)"), 1, 0)
| where has_traversal=1
| stats count values(uri) as urls by src_ip, host
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-85310,">
  <rule id="10085310" level="10">
    <if_sid>31100</if_sid>
    <id>^31</id>
    <match>import_contacts</match>
    <regex>\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c|\.\.\.\.//</regex>
    <description>CVE-2026-85310: Groundhogg import_contacts path traversal attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85310,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict access to the Groundhogg import functionality to the smallest possible set of trusted accounts; remove import privileges from editor-level roles where feasible.
   • Apply network/edge filtering (WAF, reverse proxy) to block requests containing traversal sequences (../, encoded variants, ....//) targeting plugin endpoints.
   • Enforce filesystem least privilege for the web user so that even successful traversal exposes a minimal readable file set.
   • Monitor web logs for the detection signatures above and alert on any traversal sequence reaching Groundhogg endpoints.

2. Patch / upgrade steps

   • No vendor patch is currently identified. Track the Groundhogg project's changelog and WordPress plugin repository for security releases. Only versions above the affected range (4.7.1) should be assumed safe once a fix is confirmed.
   • Because patch confidence is 0/4, do not assume any current version is fixed. Verify vendor guidance directly before downgrading urgency.

3. Long-term hardening

   • Adopt canonicalization-based input validation for all file-path handling in imported/third-party plugins rather than blacklist filtering (the root cause class, CWE-35).
   • Maintain an inventory of installed WordPress plugins with vulnerability-tracking integration.
   • Segment WordPress hosting environments so that file-read disclosure does not yield directly reachable production secrets.
   • Rotate any credentials that could have been exposed if traversal is suspected (wp-config.php, database, API keys).

References

1. NVD — CVE-2026-85310: https://nvd.nist.gov/vuln/detail/CVE-2026-85310
2. CWE-35 (Path Traversal: '.../...//'): https://cwe.mitre.org/data/definitions/35.html
3. Groundhogg plugin (WordPress.org): https://wordpress.org/plugins/groundhogg/
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild note: No CISA KEV listing, no public PoC, no exploit code, and no Nuclei template are available for CVE-2026-85310 as of this report. No campaign attribution or in-the-wild exploitation evidence is present in the provided data; EPSS has not yet scored this CVE.