The plugin omits file‑type checks in copy_post_image(), letting any file be stored on the server. An unauthenticated attacker can then place executable code or other malicious files, creating a pathway to remote code execution. The flaw is a classic file‑upload vulnerability (CWE‑434).

Any WordPress site running Gravity Forms version 2.9.20 or earlier is affected. The risk materializes only when allow_url_fopen is enabled, the public post‑creation form is active, and that form contains a file‑upload field. Sites that have disabled the form or turned off allow_url_fopen are not directly exploitable.

The severity is high with a CVSS score of 9.8, but the EPSS score of <1% indicates that exploitation is presently unlikely on a large scale, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is user‑controlled and requires no authentication, the attack vector is likely a simple HTTP request to the front‑end form, potentially accompanied by a crafted URL that injects a malicious file. Enforcing proper file‑type validation would close the window for malicious uploads.