Gravity Forms <= 2.10.4 — Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter

Overview

Advisory ID

CVE-2026-12997

Product

Gravity Forms gravityforms

Affected

≤2.10.4

Fixed in

2.10.5

Weakness

CWE-22 Path Traversal

Required access

No account needed

Published

Jul 15, 2026 · updated Nov 13, 2026

Credit

daroo

Source

Wordfence Intelligence

The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform_uploaded_files' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the targeted form to not enforce login (so publicly accessible), which allows the unauthenticated attacker to reach the process_send_resume_link endpoint and supply an arbitrary recipient email address to receive the traversal-retrieved file as a notification attachment.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to version 2.10.5, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.