CVE-2026-48866 - WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability

Back Back to CVE browser

CRITICAL

WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability

Published Jun 1, 2026

9.6

CRITICAL

CVSS 3.1

EPSS 0.50%

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal.

This issue affects Gravity Forms: from n/a through 2.10.0.1.

Affected products

Vendor Rocketgenius Inc. Product Gravity Forms Default
unaffected
Affected
- ≤ 2.10.0.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Rocketgenius Inc.	Gravity Forms	unaffected	Affected ≤ 2.10.0.1

Remediation

Vendor solution

Update the WordPress Gravity Forms Plugin to the latest available version (at least 2.10.1).

Weaknesses (1)

CWE-22

Path Traversal

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33650		Advisory
https://patchstack.com/database/wordpress/plugin/gravityforms/vulnerability/wordpress-gravity-forms-plugin-2-10-0-1-arbitrary-file-deletion-vulnerability?_s_id=cve		vdb-entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Patchstack

Published Jun 1, 2026

Updated Jun 1, 2026

Reserved May 25, 2026

Link CVE-2026-48866

CISA Vulnrichment

Updated Jun 1, 2026

NVD

Status Deferred

Modified Jul 22, 2026

Link CVE-2026-48866

Red Hat

No data

ENISA EUVD

Assigner Patchstack

Published Jun 1, 2026

Updated Jun 1, 2026

Link EUVD-2026-33650

GitHub

No data