CVE-2026-19513
Received Received - Intake

Arbitrary File Upload in Gravity Forms WordPress Plugin

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Wordfence

Description
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This makes it possible for unauthenticated attackers, when a public form contains a File Upload field with Multiple Files enabled, to upload a valid PNG/PDF polyglot to an attacker-selected public `.php` or `.html` filename in the Gravity Forms temporary upload directory. This can lead to remote code execution on WordPress systems that use NGINX or other non `.htaccess` respecting web servers. NOTE: During installation and activation, the Gravity Forms plugin places a `.htaccess` file in this directory, which prevents this vulnerability from being exploited despite the PHP file being written to the temporary upload directory. In these cases where PHP execution is blocked, attacker-written HTML can result in stored same-origin cross-site scripting if a victim visits the generated file URL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-19513
EUVD
EUVD-2026-69135

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
rocketgenius gravity_forms to 3.0.2 (inc)
rocketgenius gravity_forms 2.9.18
rocketgenius gravity_forms 2.9.29

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Gravity Forms plugin for WordPress has an Arbitrary File Upload vulnerability in versions up to 3.0.2. It allows unauthenticated attackers to upload malicious files like PHP or HTML to the server by exploiting insufficient validation of file upload chunks. This can lead to remote code execution if the server uses NGINX or similar web servers that do not respect .htaccess restrictions. Even if PHP execution is blocked, attacker-uploaded HTML files could cause stored cross-site scripting attacks.

Detection Guidance

Check Gravity Forms plugin version. If using version <= 3.0.2, the system is vulnerable. Inspect temporary upload directories for unexpected PHP or HTML files. Review server logs for unusual file uploads or access to form state URLs.

Impact Analysis

This vulnerability allows attackers to upload malicious files to your WordPress server, potentially leading to remote code execution. If your server runs NGINX or a non-.htaccess respecting web server, attackers could execute arbitrary code. Even if PHP execution is blocked, stored cross-site scripting attacks could occur, compromising user data and site integrity.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or code execution, violating GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties, reputational damage, and loss of trust. Organizations must address this flaw to maintain regulatory compliance.

Mitigation Strategies

Update Gravity Forms plugin to the latest version. Remove any unauthorized files in temporary upload directories. Disable public form File Upload fields with Multiple Files enabled. Monitor for suspicious activity in server logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19513. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart