CVE-2019-15647: Groundhogg

High severity, CVSS 8.8. EPSS: 4.5% chance of exploitation in the next 30 days.

The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.

Affected products

• Groundhogg Groundhogg: before 1.3.5 (fixed in 1.3.5)

Published 2019-08-27. Last modified 2026-06-17.