Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2026-48866

WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Patchstack

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Rocketgenius Inc. Gravity Forms

Default version status: unaffected

  • n/a to ≤ 2.10.0.1affected

References