CVE-2026-48866: WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability

Synopsis

A path traversal vulnerability in the Gravity Forms WordPress plugin (versions up to and including 2.10.0.1) allows a remote attacker to delete arbitrary files on the underlying server. The vulnerability is reachable over the network and requires no authentication, but does require a victim to perform some interaction, such as visiting a crafted URL or submitting a malicious form. Successful exploitation gives the attacker the ability to read sensitive files, tamper with server data, and disrupt service availability. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected WordPress instance over the network; the service must be exposed to the internet or another network the attacker can access.

• AuthenticationNot required

  No account or session credential is needed; the vulnerability is exploitable by an unauthenticated attacker.

• Victim interactionRequired

  A user with an active session or browser context must perform an action such as visiting a crafted link or submitting a manipulated form request, making social engineering a prerequisite.

• Attack complexityDetail

  Exploit complexity is low; no race conditions, special memory layout, or environment-specific conditions are required to trigger the path traversal reliably.

Blast Radius

• Attacker can delete arbitrary files on the server, including WordPress core files, configuration files such as wp-config.php containing database credentials, and any other files the web server process can reach.
• Attacker can read sensitive files accessible to the web server process, exposing credentials, API keys, or customer data stored on the filesystem.
• Attacker can modify or corrupt persisted data by deleting files that back application state, potentially causing data loss or enabling further exploitation after integrity is broken.
• Deleting critical application or system files crashes the affected service or renders the WordPress installation unbootable, causing a denial of service.