---
id: 6163
title: "CVE-2026-48866 — WordPress Gravity Forms Plugin File Upload Path Traversal Arbitrary File Deletion"
cve: CVE-2026-48866
source_domain: aretiq.ai
source_url: "https://aretiq.ai/research/vul260601-cve-2026-48866-wordpress-gravity-forms-plugin-file-upload-path-traversal-arbitrary-file-deletion/"
published_at: "2026-06-01T00:00:00Z"
tags: ["vulnerability-research", "web-security", "wordpress", "path-traversal", "cve-2026-48866", "gravity-forms", "arbitrary-file-deletion"]
phying_url: "https://phying.com/item/6163"
lang: en
---

# CVE-2026-48866 — WordPress Gravity Forms Plugin File Upload Path Traversal Arbitrary File Deletion

## Summary

CVE-2026-48866: unauthenticated attackers can poison Gravity Forms entries with ../ sequences that delete arbitrary server files, including wp-config.php, when an admin removes the entry.

## Intelligence Metadata

- **Sources:** aretiq.ai
- **CVE:** CVE-2026-48866
- **Published:** 2026-06-01T00:00:00Z
- **Original:** https://aretiq.ai/research/vul260601-cve-2026-48866-wordpress-gravity-forms-plugin-file-upload-path-traversal-arbitrary-file-deletion/
- **Phying News:** https://phying.com/item/6163