Description
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
Published: 2026-09-19
Score: 9.8 Critical
EPSS: 3.9% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in Gravity Forms allows an attacker to upload arbitrary files through a hidden form field that bypasses the extension validation pipeline. Because the upload state of a rejected file is later re‑used without re‑validation, an attacker can place executable code in the file. This flaw can lead to remote code execution on the hosting server. The weakness is an example of improper file validation (CWE-434).

Affected Systems

All installations of the Gravity Forms plugin for WordPress with a version of 3.1.0.4 or earlier are affected. The issue exists in every form that contains a File Upload field whose visibility is set to Hidden.

Risk and Exploitability

The flaw carries a CVSS score of 9.8, indicating critical severity. The EPSS score is 3%, indicating moderate exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need only access a publicly available form that includes a hidden file upload field; no authentication is required. Its execution path is through an HTTP request to the Gravity Forms upload handler, making it exploitable from any internet‑connected location.

Generated by OpenCVE AI on September 22, 2026 at 15:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Gravity Forms to version 3.1.0.5 or later (the patch removes the hidden field bypass).
  • If an upgrade is not immediately possible, disable or remove any File Upload fields that are set to Hidden in all forms.
  • Configure the server or plugin settings to block uploads of executable file types, ensuring only approved file extensions are allowed.

Generated by OpenCVE AI on September 22, 2026 at 15:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 19 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Gravityforms
Gravityforms gravity Forms
Wordpress
Wordpress wordpress
Vendors & Products Gravityforms
Gravityforms gravity Forms
Wordpress
Wordpress wordpress

Sat, 19 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 19 Sep 2026 02:45:00 +0000

Type Values Removed Values Added
Description The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
Title Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Gravityforms Gravity Forms
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-19T14:01:26.965Z

Reserved: 2026-09-01T19:01:43.199Z

Link: CVE-2026-84434

cve-icon Vulnrichment

Updated: 2026-09-19T13:57:53.551Z

cve-icon NVD

Status : Deferred

Published: 2026-09-19T03:17:15.573

Modified: 2026-09-21T13:33:33.387

Link: CVE-2026-84434

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T15:45:17Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type