Gravity Forms, a popular WordPress plugin, is vulnerable to arbitrary file uploads because the legacy chunked upload mechanism performs no file type validation. The extension blacklist mistakenly excludes .phar files, allowing an attacker to upload a .phar payload, which can contain PHP code. If the web server is configured to process .phar files as PHP, the attacker can execute code directly on the server, compromising confidentiality, integrity, and availability.

The vulnerability affects all users of Gravity Forms versions up to and including 2.9.21.1 running on WordPress sites. The attack surface includes the upload path that the chunked upload routine uses; discovery or enumeration of this path is required for exploitation.

The CVSS score of 8.1 indicates a high severity flaw. The EPSS score of less than 1% suggests that exploitation is unlikely at present, but the lack of a KEV listing does not negate the need for remediation. Attackers could exploit the flaw from any network position without authentication, provided they can find the upload directory, and the server is configured to execute .phar files.