CVE-2026-12997: Gravity Forms Path Traversal Vulnerability

CVE-2026-12997 Overview

CVE-2026-12997 is a directory traversal vulnerability [CWE-22] in the Gravity Forms plugin for WordPress. The flaw affects all versions up to and including 2.10.4 and stems from improper sanitization of the gform_uploaded_files parameter. Unauthenticated attackers can read arbitrary files on the underlying server, including files containing credentials, configuration data, and secrets.

Exploitation requires a publicly accessible form that does not enforce login. Attackers reach the process_send_resume_link endpoint, supply an arbitrary recipient email address, and receive the traversal-retrieved file as a notification attachment. The vulnerability affects confidentiality but does not impact integrity or availability.

Critical Impact
Unauthenticated remote attackers can exfiltrate arbitrary server files, including wp-config.php, through a public-facing form endpoint.

Affected Products

Gravity Forms plugin for WordPress, all versions through 2.10.4
WordPress sites hosting publicly accessible Gravity Forms forms
WordPress sites using the resume link feature in Gravity Forms

Discovery Timeline

2026-07-15 - CVE-2026-12997 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-12997

Vulnerability Analysis

The vulnerability resides in how Gravity Forms handles the gform_uploaded_files parameter during form processing. The plugin fails to normalize or validate file path input before referencing it as an attachment for outbound notifications. An attacker supplies a traversal sequence such as ../../../../etc/passwd or ../../wp-config.php to reference files outside the intended upload directory.

The attack chains this traversal with the process_send_resume_link endpoint. This endpoint is designed to email a link so a user can resume a partially completed form. Because the endpoint accepts an attacker-controlled recipient email address, the retrieved file is delivered directly to an inbox the attacker controls.

The Exploit Prediction Scoring System places CVE-2026-12997 at the 45th percentile. No public proof-of-concept exploit has been observed at time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing path canonicalization and allow-list validation on the gform_uploaded_files parameter. The plugin trusts client-supplied file references and passes them to the notification attachment routine without confirming the resolved path stays within the intended upload directory.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a crafted request to a publicly accessible form that triggers the process_send_resume_link handler. The request contains a traversal payload in the gform_uploaded_files parameter and an attacker-controlled recipient address. The WordPress server reads the referenced file and mails it to the attacker as a notification attachment.

The vulnerability manifests through parameter tampering rather than code injection. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-12997

Indicators of Compromise

POST requests to Gravity Forms endpoints containing gform_uploaded_files values with ../ or URL-encoded traversal sequences such as %2e%2e%2f
Outbound SMTP messages generated by WordPress containing attachments whose filenames reference wp-config.php, .env, /etc/passwd, or other sensitive paths
Requests targeting the process_send_resume_link action from unfamiliar IP addresses or automated user agents
Unusual recipient email addresses configured on resume-link notifications not matching known form submitters

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php or Gravity Forms REST routes that include gform_uploaded_files with traversal patterns
Deploy WAF rules that block path traversal sequences in Gravity Forms parameters
Correlate WordPress mail logs with request logs to identify notifications triggered by anonymous form submissions containing external recipient addresses

Monitoring Recommendations

Enable verbose logging for the Gravity Forms plugin and forward WordPress access logs to a centralized log store
Alert on any file read of wp-config.php, .env, or SSH key material by the web server user during Gravity Forms request processing
Monitor outbound mail volume from WordPress hosts for spikes tied to resume-link notifications

How to Mitigate CVE-2026-12997

Immediate Actions Required

Update the Gravity Forms plugin to a version later than 2.10.4 as soon as the vendor publishes a fixed release
Audit all public-facing Gravity Forms forms and require login where feasible to remove the unauthenticated attack surface
Review WordPress mail logs for suspicious resume-link notifications sent to external recipients since the plugin was installed
Rotate credentials stored in wp-config.php and any secrets referenced by files potentially exposed through the endpoint

Patch Information

Refer to the Gravity Forms official site for the latest plugin release and vendor advisory. Apply the fixed version through the WordPress plugin manager and verify the installed version reports higher than 2.10.4 after the update.

Workarounds

Disable the resume-link feature on all public forms until the plugin is updated
Restrict access to Gravity Forms forms by requiring authentication or IP allow-listing
Deploy a WAF rule that rejects any request containing gform_uploaded_files values with ../, ..\, or URL-encoded traversal characters
Set WordPress file system permissions so the web server user cannot read sensitive files such as wp-config.php outside expected directories

bash

# Example ModSecurity rule to block traversal in the vulnerable parameter
SecRule ARGS:gform_uploaded_files "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
    "id:1029997,phase:2,deny,status:403,log,\
    msg:'CVE-2026-12997 Gravity Forms directory traversal attempt'"