Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal.

This iss…

A path traversal vulnerability (CVE-2026-48866) has been identified in Rocketgenius Inc. Gravity Forms plugin for WordPress. The vulnerability is classified as 'Improper Limitation of a Pathname to a Restricted Directory' and allows attackers to perform path traversal attacks. This security flaw affects Gravity Forms versions from unknown starting point through version 2.10.0.1. The vulnerability enables arbitrary file deletion according to the Patchstack database. This represents a significant security risk for WordPress sites using the affected versions of the Gravity Forms plugin.