Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal.

This iss…

A path traversal vulnerability (CVE-2026-48866) has been discovered in Rocketgenius Inc. Gravity Forms WordPress plugin. The vulnerability allows improper limitation of pathnames to restricted directories, enabling path traversal attacks. This issue affects Gravity Forms versions through 2.10.0.1. The vulnerability could potentially allow arbitrary file deletion on affected systems. The issue has been documented by both NIST NVD and Patchstack security databases.