Unauthenticated Arbitrary File Upload in Gravity Forms

Gravity Forms, a popular form-building plugin for WordPress, contains a critical vulnerability (CVE-2026-84434) in versions up to and including 3.1.0.4. The flaw exists within the upload_file() function and stems from a validation bypass when processing File Upload fields configured with 'Hidden' visibility. Because the field validation pipeline and file persistence pipeline operate independently, hidden fields are not subjected to the same extension restrictions as standard fields. Furthermore, rejected files may still be processed by the upload_file() function without secondary validation, enabling unauthenticated remote attackers to upload executable scripts to the web server. Successful exploitation facilitates remote code execution (RCE) on the underlying WordPress environment, representing a severe risk for any site utilizing hidden file upload components on public-facing forms.

Attack Chain

1. Attacker identifies a target WordPress site running a vulnerable version of Gravity Forms.
2. Attacker probes the site to discover publicly accessible forms containing File Upload fields with 'Hidden' visibility.
3. Attacker crafts a malicious HTTP POST request targeting the form submission endpoint, embedding a webshell (e.g., .php extension) within the hidden file field.
4. The plugin's validation pipeline fails to apply standard extension restrictions due to the field's 'Hidden' status.
5. The file data is passed to the upload_file() function for persistence.
6. The web server saves the attacker-supplied file to a reachable directory.
7. Attacker executes the uploaded file via a direct HTTP request to the stored location.
8. Attacker gains RCE and proceeds with further post-exploitation activities.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the web server. This leads to full site compromise, potential data exfiltration of user records or database contents, and the installation of persistent backdoors or web shells, affecting any WordPress environment utilizing vulnerable versions of the plugin.

Recommendation

• Immediately upgrade the Gravity Forms plugin to the latest patched version available.
• Audit all active Gravity Forms on public-facing pages for File Upload fields with 'Hidden' visibility.
• Temporarily disable File Upload fields in public forms until the plugin is updated.
• Monitor web server access logs for anomalous POST requests to form submission endpoints followed by immediate requests to newly created files in the uploads directory.