The Gravity Forms plugin for WordPress allows unauthenticated users to upload files when a public form contains a File Upload field with Multiple Files enabled. An attacker can reuse the public form state URL hash as a chunk continuation hash, bypassing validation in GFAsyncUpload::upload(). This permits uploading a valid PNG/PDF polyglot with an attacker‑chosen .php or .html filename into the temporary upload directory. Because the uploaded file is not sanitized before storage, the vulnerability is a classic arbitrary file upload flaw (CWE‑434) that can lead to remote code execution on servers that serve the temporary upload directory without execution restrictions, such as NGINX or other non‑.htaccess‑respecting stacks. If PHP execution is blocked, an attacker can still place an HTML file that triggers same‑origin stored XSS when opened.

All installations of Gravity Forms version 3.0.2 or earlier that expose a publicly accessible form with a File Upload field configured for Multiple Files are affected. The plugin creates a temporary upload directory upon activation, and the flaw resides in the upload routine; it does not depend on other WordPress settings beyond the presence of that directory. Systems that remove or rename the default .htaccess file in that directory are at greater risk, as the protective rule is absent.

The flaw carries a CVSS score of 8.1, indicating high severity. The EPSS score is not reported, but the lack of authentication requirements and broad distribution make it likely to be abused. It is not yet catalogued in CISA’s KEV list. Exploitation requires only a crafted multi‑file upload to a permissive public form, after which an attacker can achieve RCE if the server permits execution from the temporary upload directory, or stored XSS if execution is blocked. The combination of high impact and low attack effort warrants immediate remediation.