Technical impact
The Gravity Forms plugin for WordPress contains a directory traversal flaw in the 'gform_uploaded_files' parameter that allows an unauthenticated attacker to read arbitrary files on the server. This vulnerability is triggered when the form is publicly accessible; the attacker supplies a non‑existent file path to the process_send_resume_link endpoint, causing the plugin to attach the requested file to a notification email sent to an arbitrary address. The flaw, classified as CWE‑22, exposes sensitive data and undermines confidentiality, while the absence of authentication means the attack surface is broad.
Affected Systems
All installations of Gravity Forms up to and including version 2.10.4 on WordPress sites are affected. The plug‑in, developed by Gravity Forms, can be found on WordPress installations that have not upgraded beyond this version. No other vendors or products were reported to be included in the CNA's inventory for this CVE.
Risk and Exploitability
The severity of the flaw is high, with a CVSS score of 7.5. The EPSS score is less than 1 %, indicating a very low probability that exploitation will be observed in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, exploitation requires only a public form endpoint and the ability to send an email address, both of which are readily available to an attacker. Once exploited, the attacker can read any readable file on the server, including configuration files or credentials, and exfiltrate them through the email notification mechanism. Therefore, although the likelihood of active exploitation appears low, the potential impact of a successful exploit remains significant.
