Gravity Forms <= 2.10.4 Unauthenticated Arbitrary File Read via Directory Traversal (CVE-2026-12997)

Vulnerability Overview Vulnerability Name: Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter CVE ID: CVE-2026-12997 CVSS Score: 7.5 Publication Date: July 15, 2026 Last Update Date: July 15, 2026 Researcher: daroo Impact Scope Software Type: Plugin Software Name: Gravity Forms Affected Versions: <= 2.10.4 Fixed Version: 2.10.5 Remediation Recommendation: Upgrade to version 2.10.5 or a newer patched version. Vulnerability Description The Gravity Forms plugin contains a directory traversal vulnerability in WordPress, affecting all versions including 2.10.4. Attackers can read arbitrary files on the server via the parameter, which may contain sensitive information. Exploiting this vulnerability requires the target server to not enforce authentication (i.e., it is publicly accessible), allowing an unauthenticated attacker to access the endpoint and forge an arbitrary recipient email address to receive the traversed and retrieved files as attachments. References www.gravityforms.com Recent Vulnerabilities Gravity Forms <= 2.10.1 - Unauthenticated Arbitrary File Deletion (CVE-2026-48866, CVSS 9.1) Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input (CVE-2026-5113, CVSS 7.2) Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option (CVE-2026-5109, CVSS 7.2) Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater (CVE-2026-5110, CVSS 7.2) Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater (CVE-2026-5111, CVSS 7.2) Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater (CVE-2026-5112, CVSS 7.2) Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field (CVE-2026-4394, CVSS 6.1) Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter (CVE-2026-4406, CVSS 4.7) Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title (CVE-2026-3492, CVSS 6.4) Gravity Forms <= 2.9.23.0 - Unauthenticated Arbitrary File Upload (CVE-2025-13407, CVSS 9.8) Additional Information Wordfence Intelligence offers free personal and commercial API access to its comprehensive WordPress vulnerability database. The Wordfence Intelligence WordPress Vulnerability Database is fully free to access and query via API. Contact Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: Customers receive 24/7 support with a 1-hour response time. Legal Notice Copyright: © 2012-2026 Defiant Inc. All Rights Reserved. License: Used in accordance with the licensing terms of Defiant Inc. and MITRE Corporation. Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Instagram: Instagram Subscription Subscribe to News and Updates: Subscribe to security news and updates from Wordfence Intelligence professionals by entering your email address. Footer Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Products and Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscription Form Email Address: Enter Email Address Agreement: Checking this box signifies my agreement to the Terms of Service and Privacy Policy. Subscription Button SIGN UP: SIGN UP Copyright © 2012-2026 Defiant Inc. All Rights Reserved. Logo Defiant: Defiant Logo Summary This page details a critical vulnerability in the Gravity Forms plugin, providing an overview, impact scope, remediation steps, related references, and a list of recent vulnerabilities. Additionally, it includes information about Wordfence Intelligence, contact details, legal notices, social media links, subscription forms, and footer links.

Goal Reached Thanks to every supporter — we hit 100%!

Gravity Forms <= 2.10.4 Unauthenticated Arbitrary File Read via Directory Traversal (CVE-2026-12997)

More from this source