CVE-2026-12997: Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gformuploadedfiles' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the targeted form to not enforce login (so publicly accessible), which allows the unauthenticated attacker to reach the processsendresumelink endpoint and supply an arbitrary recipient email address to receive the traversal-retrieved file as a notification attachment.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12997?
The severity of CVE-2026-12997 is rated high with a score of 7.5.
How do I fix CVE-2026-12997?
To fix CVE-2026-12997, update the Gravity Forms plugin to version 2.10.5 or later.
What type of vulnerability is CVE-2026-12997?
CVE-2026-12997 is a Directory Traversal vulnerability that allows unauthenticated file reading.
What impact does CVE-2026-12997 have on my WordPress site?
CVE-2026-12997 can allow attackers to access sensitive files on your server, potentially leading to data exposure.
Which software is affected by CVE-2026-12997?
CVE-2026-12997 affects all versions of the Gravity Forms plugin for WordPress up to and including 2.10.4.