Gravity Forms CVE-2026-12997

Exploitation requires the targeted Gravity Forms form to NOT enforce login, i.e. be publicly accessible, so an unauthenticated attacker can reach the process_send_resume_link endpoint (part of the Save-and-Continue/resume-link feature); the attacker then supplies a traversal payload in the 'gform_uploaded_files' parameter and an arbitrary recipient email address to receive the retrieved file as a notification attachment. Limiting factors that reduce real-world risk: the form must expose the resume-link workflow and be anonymously accessible (login-gated or non-resume forms are not exploitable via this path), the affected version must be 2.10.4 or earlier, and the attacker must be able to receive email at the supplied address; impact is read-only (C:H, I:N, A:N) with no code execution or data modification.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated confidentiality-only issue, consistent with the description of unauthenticated arbitrary file reads. However, the description adds a real limiting precondition not reflected in AC:L - the targeted form must not enforce login (be publicly accessible) and must expose the resume-link workflow - which narrows the exploitable population below what a raw 7.5 implies. There is no EPSS score, no KEV listing, and no POC signal in the provided data, so this is a genuine but not confirmed-exploited priority: high impact where a vulnerable public form exists, but exploitation is conditional rather than universal. SSVC-style read: exploitation is not observed, technical impact is partial (read-only), and automatability is plausible against exposed forms but gated by configuration.

An attacker locates a publicly accessible Gravity Forms form that does not enforce login and uses the resume-link workflow, then sends a crafted request to the process_send_resume_link endpoint with a 'gform_uploaded_files' value containing directory-traversal sequences (e.g. pointing at wp-config.php or /etc/passwd) and an attacker-controlled recipient email. The plugin retrieves the traversed file and delivers it as a notification attachment to that inbox, exfiltrating credentials or configuration secrets. No POC is publicly identified, and the low attack complexity (AC:L) plus lack of required authentication (PR:N) make hands-on exploitation straightforward once a qualifying form is found.