The vulnerability identified as CVE-2026-48866 in Rocketgenius Inc.'s Gravity Forms plugin is a CWE-22 path traversal issue. It allows improper limitation of a pathname to a restricted directory, enabling an attacker to access files outside the intended directory scope. This affects versions up to 2.10.0.1. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published yet.

Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system due to path traversal allowing unauthorized file access and potential further system compromise. The vulnerability is critical given the high CVSS score and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin, limit user permissions, and monitor for suspicious activity related to file access. Avoid exposing vulnerable versions to untrusted users.