PT-2026-45440 · WordPress · Gravity Forms

Daroo · CVE-2026-48866 · Published 2026-06-01 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 2.10.0.2

Description An improper limitation of a pathname to a restricted directory, known as Path Traversal, exists in Gravity Forms. This allows an attacker to access files and directories outside of the intended folder.

Recommendations Update to version 2.10.0.2 or later.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-48866

Affected Products

Gravity Forms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-48866 · Security Note
• https://twitter.com/DFIR_Lab/status/2062339895452897449 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2061480556634771800 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/gravityforms/vulnerability/wordpress-gravity-forms-plugin-2-10-0-1-arbitrary-file-deletion-vulnerability?_s_id=cve · Note
• https://twitter.com/UpwindMDR/status/2061705538962968719 · Twitter Post