Vulnerability · Published Sep 19, 2026 · Assigned by Wordfence
CVE-2026-84434Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Critical 9.8
In plain English
A critical-severity unrestricted file upload in Gravity Forms from Gravity Forms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gravity Forms | Gravity Forms | 0 – through 3.1.0.4 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H