CVE-2026-48866

Vulnerability

The Gravity Forms plugin for WordPress versions from n/a through 2.10.0.1 contains a path traversal vulnerability (CWE-22) in the file handling logic. An attacker can manipulate file paths to access restricted directories, leading to arbitrary file deletion. The vulnerability is present in all versions up to and including 2.10.0.1. [1]

Exploitation

Exploitation requires a privileged user account (e.g., administrator) and user interaction, such as clicking a malicious link or submitting a crafted form. The attacker must have the ability to trigger the vulnerable file operation. The Patchstack advisory notes that this vulnerability is expected to be used in mass-exploit campaigns. [1]

Impact

Successful exploitation allows an attacker to delete arbitrary files from the WordPress installation, including core files. This can cause the website to break and stop functioning, leading to denial of service and potential data loss. The CVSS score is 9.6 (Critical). [1]

Mitigation

The vulnerability is fixed in version 2.10.1. Users should update immediately. If unable to update, Patchstack offers a mitigation rule to block attacks. No other workarounds are mentioned. The vulnerability is listed as likely to be exploited. [1]