CVE-2026-84434

Overview

The Gravity Forms plugin for WordPress up to version 3.1.0.4 contains an arbitrary file upload vulnerability in the upload_file function. A validation mismatch allows unauthenticated attackers to bypass extension checks on hidden file upload fields and achieve remote code execution. This flaw poses a critical risk to websites utilizing affected forms.

Description

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.

Impact

This vulnerability impacts the integrity and availability of the WordPress site, and critically compromises confidentiality by allowing potential remote code execution. Unauthenticated attackers can leverage publicly accessible forms containing hidden file upload fields to execute arbitrary code on the underlying server. Complete system compromise is possible for affected organizations.

Remediation

Update the Gravity Forms plugin to the latest patched version immediately where the validation pipeline mismatch is resolved. Audit existing public-facing forms to identify and reconfigure any File Upload fields utilizing hidden visibility settings. Implement strict web application firewall rules and file integrity monitoring to detect anomalous uploads.

Risk context

Rated critical with a CVSS v3 score of 9.8, indicating the highest level of severity due to unauthenticated remote code execution potential. While the current EPSS score is 0.00697, the public availability of detailed mechanics and the requirement of only a hidden file upload field necessitate urgent patching.

Affected products

• Gravity Forms WordPress Plugin