What is the CVSS score of CVE-2026-12997?

CVE-2026-12997 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Which versions of Gravity Forms are affected by CVE-2026-12997?

Gravity Forms, present on an estimated 90%+ of surveyed WordPress installations, contains an unauthenticated arbitrary file disclosure vulnerability (CVE-2026-12997, CVSS 7.5) enabling attackers to…

How to fix or mitigate CVE-2026-12997?

Within 24 hours, identify all WordPress instances running Gravity Forms versions 2.10.4 and earlier; immediately disable email attachment functionality in affected form notifications and restrict file upload directory permissions to prevent traversal exploitation. Within 7 days, deploy WAF rules to block requests containing 'gform_uploaded_files' parameter traversal patterns against the 'process_send_resume_link' endpoint, and enable detailed logging on all file access attempts to detect exploitation. Within 30 days, monitor Gravity Forms security releases for a patched version; upon availability, prioritize upgrade to the fixed version across all affected installations, then systematically re-enable form features while validating the exploit path remains blocked.

Gravity Forms CVE-2026-12997

EUVD-2026-44761 HIGH

Path Traversal (CWE-22)

2026-07-15 Wordfence

WordPress Path Traversal Gravity Forms

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (Wordfence) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network read via a public form endpoint (AV:N/PR:N/UI:N/AC:L); confidentiality-only file disclosure (C:H) with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 19:00 vuln.today

CVE Published

Jul 15, 2026 - 18:34 cve.org

HIGH 7.5

DescriptionNVD

The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform_uploaded_files' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the targeted form to not enforce login (so publicly accessible), which allows the unauthenticated attacker to reach the process_send_resume_link endpoint and supply an arbitrary recipient email address to receive the traversal-retrieved file as a notification attachment.

Articles & Coverage 1

News 4 New WordPress Vulnerabilities - 4 High Severity, 2 With POC Jul 16, 2026

AnalysisAI

Arbitrary file disclosure in the Gravity Forms WordPress plugin (all versions through 2.10.4) lets unauthenticated attackers read sensitive files from the web server by abusing the 'gform_uploaded_files' parameter against the process_send_resume_link endpoint. Reported by Wordfence, the flaw carries CVSS 7.5 and is exfiltrated by directing the traversal-retrieved file to an attacker-controlled email as a form notification attachment. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Gravity Forms is a widely deployed commercial form-builder plugin for WordPress that supports 'Save and Continue' functionality, which generates a resume link and can email it (with attachments) via the process_send_resume_link handler. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): the 'gform_uploaded_files' parameter is used to reference uploaded file paths without adequate normalization or containment, allowing '../' sequences to escape the intended upload directory and resolve to arbitrary filesystem paths readable by the PHP/web-server process. The affected component is identified by CPE cpe:2.3:a:gravity_forms:gravity_forms:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch version is identified in the available data, so upgrade to the latest Gravity Forms release beyond 2.10.4 as soon as the vendor publishes a fixed build, monitoring the vendor site (https://www.gravityforms.com/) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/5c03c07f-8f41-47c2-bc95-d92a623f5f7c?source=cve) for the exact patched version. As compensating controls until patched: require login on forms that use file uploads or Save-and-Continue (this removes the unauthenticated reachability that the exploit depends on, at the cost of blocking anonymous submissions); disable the Save and Continue / resume-link feature on public forms (breaks partial-submission resumption for legitimate users); and place a WAF rule to block requests to the process_send_resume_link endpoint containing traversal sequences such as '../' or encoded variants in 'gform_uploaded_files' (watch for false positives on legitimate file paths). Restrict web-server filesystem permissions so the PHP process cannot read sensitive files outside the webroot to limit the blast radius.