CVE-2026-84434

Received Received - Intake

Arbitrary File Upload in Gravity Forms WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-84434

Affected Vendors & Products

Vendor	Product	Version / Range
gravity_forms	gravity_forms	to 3.1.0.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability in the Gravity Forms WordPress plugin allows unauthenticated attackers to upload executable files via a hidden File Upload field. The issue occurs because file validation is bypassed when hidden fields are used, and rejected files remain in an uploadable state. The upload_file function then processes these files without re-validation, enabling remote code execution.

Detection Guidance

Check WordPress sites for Gravity Forms versions up to 3.1.0.4. Look for forms with hidden File Upload fields. Inspect server upload directories for unexpected executable files. Use WordPress admin to review form configurations.

Impact Analysis

Attackers could exploit this to upload malicious files to your WordPress site, potentially gaining control over it. This could lead to website defacement, data theft, or further attacks against visitors. The high CVSS score (9.8) indicates severe impact, including full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection. Organizations may face fines or legal penalties if exploited, as compromised systems may expose sensitive user or patient data.

Mitigation Strategies

Update Gravity Forms to the latest version. Disable hidden File Upload fields in forms. Implement server-side file upload restrictions. Monitor upload directories for suspicious files. Consider temporary site lockdown if exploited.

Hi! I’m here to help you understand CVE-2026-84434. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70