Groundhogg — CRM, Newsletters, and Marketing Automation < 4.7.2 - Authenticated (Import_contacts+) Path Traversal

Description

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.7.1. This is due to insufficient validation of a user supplied path. This makes it possible for authenticated attackers, with import_contacts-level access and above, to access files and directories outside of the intended directory.