CVE-2026-48866

A critical vulnerability exists in Gravity Forms plugin versions prior to 2.10.0.1, allowing an unauthorized user to erase any file from the server by exploiting a flaw in path checking mechanisms. This oversight enables malicious actors to potentially execute arbitrary code on the affected system by deleting specific files, including sensitive configuration files like wp-config.php.

Based on public CVE data (MITRE/NVD).