CVE-2026-12997

Deferred Deferred - Pending Action

Directory Traversal in Gravity Forms WordPress Plugin

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: Wordfence

Description

The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform_uploaded_files' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the targeted form to not enforce login (so publicly accessible), which allows the unauthenticated attacker to reach the process_send_resume_link endpoint and supply an arbitrary recipient email address to receive the traversal-retrieved file as a notification attachment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-12997

EUVD

EUVD-2026-44761

Affected Vendors & Products

Vendor	Product	Version / Range
rocketgenius	gravity_forms	to 2.10.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a Directory Traversal flaw in the Gravity Forms WordPress plugin up to version 2.10.4. It allows unauthenticated attackers to read arbitrary files on the server by exploiting the 'gform_uploaded_files' parameter. Attackers can access sensitive information if the targeted form is publicly accessible and does not require login.

Detection Guidance

Check if Gravity Forms plugin version is up to 2.10.4 or lower. Inspect server logs for requests to process_send_resume_link endpoint with gform_uploaded_files parameter. Look for unusual file read attempts or attachments sent to external emails.

Impact Analysis

An attacker could exploit this to read sensitive files on your server, such as configuration files, logs, or other confidential data. If your Gravity Forms plugin is outdated or misconfigured, this could lead to data breaches or unauthorized access to critical information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using Gravity Forms may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update Gravity Forms plugin to the latest version immediately. Disable file upload features in forms if not required. Restrict public access to forms using login requirements. Monitor for suspicious activity in server logs.

Hi! I’m here to help you understand CVE-2026-12997. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70