Attack Chain

1. Attacker identifies a target WordPress site running a vulnerable version of Gravity Forms.
2. Attacker probes the site to discover publicly accessible forms containing File Upload fields with 'Hidden' visibility.
3. Attacker crafts a malicious HTTP POST request targeting the form submission endpoint, embedding a webshell (e.g., .php extension) within the hidden file field.
4. The plugin's validation pipeline fails to apply standard extension restrictions due to the field's 'Hidden' status.
5. The file data is passed to the upload_file() function for persistence.
6. The web server saves the attacker-supplied file to a reachable directory.
7. Attacker executes the uploaded file via a direct HTTP request to the stored location.
8. Attacker gains RCE and proceeds with further post-exploitation activities.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the web server. This leads to full site compromise, potential data exfiltration of user records or database contents, and the installation of persistent backdoors or web shells, affecting any WordPress environment utilizing vulnerable versions of the plugin.

Recommendation

• Immediately upgrade the Gravity Forms plugin to the latest patched version available.
• Audit all active Gravity Forms on public-facing pages for File Upload fields with 'Hidden' visibility.
• Temporarily disable File Upload fields in public forms until the plugin is updated.
• Monitor web server access logs for anomalous POST requests to form submission endpoints followed by immediate requests to newly created files in the uploads directory.