Gravity Forms Unauthenticated File Upload Lets Attackers Achieve RCE

Executive Summary

A critical arbitrary file upload vulnerability (CVE-2026-84434) has been disclosed in Gravity Forms, one of the most widely deployed WordPress form builder plugins with millions of active installations. The flaw carries a CVSS score of 9.8 and lets unauthenticated attackers upload files that may execute on the server, leading to remote code execution.

CVSS Score: 9.8 (Critical)

The bug lives in a mismatch between Gravity Forms' field validation pipeline and its file persistence pipeline. When a form includes a File Upload field with its visibility set to Hidden, extension validation is skipped during the validation stage — but the plugin's upload_file() function still writes the submitted file to disk without re-checking it. An attacker only needs access to a public page containing such a form; no account or credentials are required.

Vulnerability Overview

Affected Versions

Attack Vector

1. Attacker identifies a publicly accessible Gravity Forms form
2. Form contains a File Upload field configured with Visibility = Hidden
3. Hidden fields skip extension validation in the plugin's validation pipeline
4. Attacker POSTs a crafted request with a malicious file to the hidden field
5. upload_file() persists the file to wp-content/uploads/gravity_forms/ without re-validation
6. If the upload directory allows script execution, the file runs as code

Gravity Forms typically ships .htaccess rules that block PHP execution inside its upload directory, so real-world impact depends heavily on server configuration — non-Apache stacks (nginx, alternate docroots, misconfigured rewrite rules) are at the highest risk of full RCE. Even where execution is blocked, the upload itself still succeeds, which can be chained with other flaws or used to plant files for later retrieval.

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update to Version 3.1.0.5

# Via WP-CLI
wp plugin update gravityforms
 
# Verify the installed version
wp plugin get gravityforms --field=version

Or update through WordPress admin: Plugins > Installed Plugins > Gravity Forms > Update Now.

Step 2: Audit Forms for Hidden File Upload Fields

1. Review every published form in Forms > All Forms
2. Check each File Upload field's Visibility setting
3. Remove or set to Visible any hidden File Upload fields that aren't required to be hidden

Step 3: Scan for Existing Compromise

# Search for recently written files in the Gravity Forms upload directory
find /path/to/wordpress/wp-content/uploads/gravity_forms/ -type f -newer /path/to/wordpress/wp-includes/version.php
 
# Check for common webshell signatures
grep -rl "eval\s*(base64_decode" /path/to/wordpress/wp-content/uploads/gravity_forms/
grep -rl "system\s*(\|shell_exec\s*(" /path/to/wordpress/wp-content/uploads/gravity_forms/
 
# Verify WordPress core integrity
wp core verify-checksums

If Immediate Patching Is Not Possible

1. Set all File Upload fields to Visible so extension validation applies
2. Block script execution in wp-content/uploads/gravity_forms/ at the web server level (deny PHP/CGI execution)
3. Deploy a WAF rule blocking POSTs with executable file extensions to Gravity Forms endpoints
4. Monitor access logs for unusual POST traffic to form submission endpoints

Detection Indicators

Post-Remediation Steps

1. Confirm plugin updated to 3.1.0.5 or later
2. Audit all forms for hidden File Upload fields and correct visibility settings
3. Scan the installation for webshells and unauthorized files
4. Review user accounts for unauthorized administrators
5. Rotate credentials — WordPress admin, database, API keys
6. Regenerate WordPress security keys using wp config shuffle-salts
7. Deploy a WAF for ongoing protection against upload-based attacks

References

• Patchstack — WordPress Gravity Forms Plugin Unauthenticated Arbitrary File Upload
• NIST NVD — CVE-2026-84434

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• WordPress Plugin Vulnerability (CVSS 10.0) Under Active
• CVE-2026-3589: WooCommerce CSRF Flaw Allows Unauthenticated