Perceptive Security
SOC/SIEM Consultancy
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal.
This iss…
Published:
31 May 2026 at 22:00:00
Alert date:
1 June 2026 at 17:02:55
Source:
nvd.nist.gov
Web Technologies
A path traversal vulnerability (CVE-2026-48866) has been identified in Rocketgenius Inc. Gravity Forms plugin for WordPress. The vulnerability is classified as 'Improper Limitation of a Pathname to a Restricted Directory' and allows attackers to perform path traversal attacks. This security flaw affects Gravity Forms versions from unknown starting point through version 2.10.0.1. The vulnerability enables arbitrary file deletion according to the Patchstack database. This represents a significant security risk for WordPress sites using the affected versions of the Gravity Forms plugin.
Technical details
Mitigation steps:
Affected products:
Gravity Forms
Related links:
https://nvd.nist.gov/vuln/detail/CVE-2026-48866
https://patchstack.com/database/wordpress/plugin/gravityforms/vulnerability/wordpress-gravity-forms-plugin-2-10-0-1-arbitrary-file-deletion-vulnerability?_s_id=cve
Related CVE's:
Related threat actors:
IOC's:
This article was created with the assistance of AI technology by Perceptive.