CVE-2026-48866Disclosure

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://patchstack.com/database/wordpress/plugin/gravityforms/vulnerability/wordpress-gravity-forms-plugin-2-10-0-1-arbitrary-file-deletion-vulnerability?_s_id=cve

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 2d ago at 1 mentions (2026-06-01); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48866

Classification over time

Date	Total	Labels

2026-06-01	1	Disclosure1
2026-06-02	1	Patch1
2026-06-04	1	Disclosure1

Full discourse3 posts

DFIR Lab@DFIR_Lab135d
Disclosure
🚨 CRITICAL: CVE-2026-48866 - Path Traversal in Gravity Forms (CVSS 9.6) Affects: Gravity Forms ≤2[.]10[.]0[.]1 Risk: Remote code execution, data breach Patch immediately! #CVE #Vulnerability #PatchNow https://t.co/Lk2P4R8UBN
Post summary
A critical path traversal vulnerability (CVE‑2026‑48866) affecting Gravity Forms is disclosed with a CVSS score of 9.6, and users are urged to apply the patch immediately due to potential remote code execution.
0000032
35 followersView on X
Upwind Security MDR@UpwindMDR136d
Patch
🚨Critical - Gravity Forms Arbitrary File Deletion (CVE-2026-48866) A critical path traversal vulnerability in Gravity Forms allows authenticated attackers to delete arbitrary files on the WordPress server. The flaw exists due to insufficient pathname validation when handling file deletion operations. Successful exploitation can lead to complete website compromise, deletion of critical WordPress files, data loss, or full site defacement. 👉 Affected: Gravity Forms ≤ 2.10.0.1 | Upgrade to Gravity Forms 2.10.0.2 or higher
Post summary
A path traversal flaw in Gravity Forms allows authenticated users to delete arbitrary files, potentially leading to full site compromise; the issue is mitigated by upgrading to version 2.10.0.2 or later.
0000059
199 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-48866 Path Traversal Vulnerability in Rocketgenius Gravity Forms Through 2.10.0.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48866
Post summary
A path traversal flaw has been disclosed for Rocketgenius Gravity Forms up to version 2.10.0.1, with technical details mentioned but no PoC, exploit, or patch information provided.
0000045
4.0K followersView on X

Explore more

Back to dashboard