CVE-2026-12997 describes a directory traversal vulnerability in the Gravity Forms plugin for WordPress affecting all versions up to 2.10.4. The vulnerability is triggered through the 'gform_uploaded_files' parameter, which can be manipulated by unauthenticated attackers to read arbitrary server files. Successful exploitation depends on the targeted form not requiring user authentication, allowing access to the process_send_resume_link endpoint and enabling the attacker to receive sensitive file contents via email notifications.

An unauthenticated attacker can read arbitrary files on the server, potentially exposing sensitive information. This can lead to information disclosure without requiring user interaction or privileges. The vulnerability does not affect integrity or availability but poses a significant confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable forms by enforcing login or other access controls to prevent unauthenticated access to the process_send_resume_link endpoint.