CVE-2026-48866
Gravity Forms, a WordPress plugin, has a path traversal flaw that lets attackers read files outside the intended directory. Versions up to 2.10.0.1 are affected. The flaw can be exploited over the network without needing special permissions.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites using the Gravity Forms plugin, any version up to and including 2.10.0.1.
Real-world impact
An attacker could read arbitrary files on the server, potentially exposing sensitive data, credentials, or configuration files, and could use that information to further compromise the site.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability can be triggered remotely, requires no special privileges, and can compromise confidentiality, integrity, and availability. The user interaction requirement is low, and the impact is high.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 1, 2026 · Jun 1, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.