← Back to the live CVE advisory feed

CVE-2026-84434: Gravity Forms

Severity

9.8 (CRITICAL)

Vendor

GRAVITY FORMS

Affected versions

0 through 3.1.0.4

Fixed version

unknown

Patch status

Unpatched

Published

2026-09-19T03:17:15.573

Modified

2026-09-19T03:17:15.573

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Prioritize immediate identification and mitigation due to critical RCE vulnerability.
• Identify if Gravity Forms plugin is installed on WordPress sites.
• Disable or remove the Gravity Forms plugin until a patch is released, especially on public-facing forms.
• If disabling/removing is not feasible, ensure no publicly accessible forms contain a 'Hidden' File Upload field.
• Monitor web server and application logs for suspicious file uploads or unexpected code execution attempts.

Technical summary

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.

View the official NVD record for CVE-2026-84434

AI-enriched (MEDIUM confidence). Validate against the vendor advisory before taking production action.