Gravity Forms CVE-2026-48866: Brief Summary of a Critical Arbitrary File Deletion via Path Traversal

Introduction

A critical path traversal vulnerability in Gravity Forms, one of the most widely deployed premium WordPress form plugins, allows unauthenticated attackers to delete arbitrary files on the server when a privileged user is tricked into triggering a crafted request. Gravity Forms runs on over 600,000 live websites, and Patchstack warns that mass exploitation campaigns are expected. WordPress administrators and security teams need to address this immediately.

Gravity Forms is a premium form builder plugin for WordPress developed by Rocketgenius Inc. It runs on an estimated 622,685 to 869,181 live websites, according to WebTechSurvey and BuiltWith, and holds roughly 7.53% market share in the WordPress plugins category. It is a paid plugin (starting at $59/year) and competes with WPForms and Formidable Forms.

Technical Information

Root Cause: CWE-22 Path Traversal

CVE-2026-48866 is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Gravity Forms accepts a filename or filepath parameter from user input and passes it to a file deletion function (such as PHP's unlink()) without adequately checking that the resolved path stays inside the intended directory. By injecting directory traversal sequences (e.g., ../), an attacker can move out of the plugin's intended file scope and target any file on the server that the web server process has permission to delete.

Patchstack classifies this as an Arbitrary File Deletion vulnerability and maps it to OWASP A1: Broken Access Control.

Attack Flow

Exploiting CVE-2026-48866 follows a pattern consistent with other WordPress arbitrary file deletion vulnerabilities:

1. The attacker identifies a target running Gravity Forms version 2.10.0.1 or earlier. Fingerprinting Gravity Forms is straightforward because it is so widely deployed.

2. The attacker crafts an HTTP request with a path traversal payload in a file deletion parameter. The payload uses ../ sequences to climb out of the plugin's intended directory and reference a target file such as wp-config.php.

3. Because the vulnerability requires user interaction, the attacker has to use social engineering to get a privileged WordPress user (typically an administrator) to trigger the malicious request. The attacker can send a crafted link by email, embed the trigger in a page the admin is likely to visit, or manipulate a form submission that the admin processes.

4. When the privileged user triggers the request, the server processes the traversal sequence and deletes the targeted file.

5. What happens next depends on which file was deleted:

   • Deleting wp-config.php resets the WordPress installation, potentially allowing the attacker to reinstall WordPress with attacker-controlled database credentials and take over the site completely.
   • Deleting .htaccess files can disable security rules and expose directory listings.
   • Deleting core PHP files from plugins or themes can cause cascading site failures.

Attack Parameters

What Remains Unknown

The vulnerable code path in Gravity Forms, the exact HTTP endpoint and parameters involved, and the CVSS vector string have not been made public. NIST has not yet published its own CVSS assessment, and the NVD page lists the score as "N/A". As of the disclosure date, no public proof-of-concept exploit code was available.

Affected Systems and Versions

Every version of Gravity Forms from the earliest available release through 2.10.0.1 is affected. Version 2.10.1, released on 30 April 2026, fixes the vulnerability.

Gravity Forms is a premium plugin and is not distributed through the WordPress.org plugin repository, so automatic updates depend on the site's license status and update configuration. Sites with expired licenses, or sites that have disabled automatic updates, may stay vulnerable longer than sites running typical WordPress plugins.

Estimates of the affected install base:

Vendor Security History

Gravity Forms has had recurring security vulnerabilities, particularly in file handling and input validation:

File handling vulnerabilities (arbitrary file upload, and now arbitrary file deletion) have recurred across multiple major version ranges, from version 1.8.19 through the current 2.10.x line. The 2015 arbitrary file upload vulnerability in version 1.8.19 had public exploit code published on Exploit-DB. Stored XSS has come up repeatedly too, with at least five distinct CVEs in the 2.9.x and 2.10.x ranges alone.

Patchstack notes that Gravity Forms has no formal Vulnerability Disclosure Program (VDP), which may limit structured engagement with security researchers and slow the intake of vulnerability reports.

To the vendor's credit, the response to CVE-2026-48866 was fast. The patch was released within approximately one day of the initial report. Public disclosure was then delayed by roughly one month, which gave Patchstack customers time to deploy the fix before details became widely available.

References

• NVD: CVE-2026-48866
• Patchstack Advisory: Arbitrary File Deletion in Gravity Forms
• Patchstack: Gravity Forms Vulnerability History
• Gravity Forms Changelog
• Gravity Forms 2.10.1 Release Announcement
• WPScan: Gravity Forms Plugin Vulnerabilities
• ZeroPath: Gravity Forms CVE-2025-12352 Summary
• Wordfence: 200,000 WordPress Sites Affected by Arbitrary File Deletion in Perfmatters
• Wordfence: Gravity Forms Unauthenticated Arbitrary File Upload
• Exploit-DB: Gravity Forms 1.8.19 Arbitrary File Upload
• WebTechSurvey: Gravity Forms Usage Statistics
• BuiltWith: Gravity Forms Usage Statistics
• Proofpoint: 2026 Vulnerability Exploitation in the Wild