EUVD-2026-69135
GHSA-fjj9-76vm-r7vp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H reflects dual precondition of multi-file public form plus NGINX hosting; PR:N confirmed by unauthenticated form submission vector; C/I/A:H for RCE path.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the GFAsyncUpload::upload() function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This makes it possible for unauthenticated attackers, when a public form contains a File Upload field with Multiple Files enabled, to upload a valid PNG/PDF polyglot to an attacker-selected public .php or .html filename in the Gravity Forms temporary upload directory. This can lead to remote code execution on WordPress systems that use NGINX or other non .htaccess respecting web servers. NOTE: During installation and activation, the Gravity Forms plugin places a .htaccess file in this directory, which prevents this vulnerability from being exploited despite the PHP file being written to the temporary upload directory. In these cases where PHP execution is blocked, attacker-written HTML can result in stored same-origin cross-site scripting if a victim visits the generated file URL.
Articles & Coverage 1
AnalysisAI
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PHP or HTML files with attacker-controlled names to the plugin's temporary upload directory by exploiting chunk-state hash reuse in the GFAsyncUpload::upload() function. On NGINX or other non-.htaccess-respecting web servers, this leads to remote code execution; on Apache deployments the plugin's bundled .htaccess file blocks PHP execution, though attacker-written .html files can still produce stored same-origin XSS if a victim visits the generated URL. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote code execution requires all three conditions simultaneously: (1) a publicly accessible Gravity Forms form with a File Upload field and Multiple Files mode enabled - authenticated-only or non-upload forms are not exploitable by unauthenticated attackers; (2) a web server that does not honor `.htaccess` directives, specifically NGINX, Caddy, or any FastCGI-based stack where PHP execution in upload directories is not restricted by server configuration; and (3) the Gravity Forms temporary upload directory must be reachable via HTTP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 High score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly captures the zero-authentication requirement and reflects high attack complexity, which is warranted given the dual preconditions: a publicly accessible form with Multiple Files upload enabled AND a non-Apache web server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Gravity Forms beyond version 3.0.2 by reviewing the vendor change log at https://docs.gravityforms.com/gravityforms-change-log/ - the precise patched release number is not confirmed in the available input data and should be verified there before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress sites running Gravity Forms ≤3.0.2 and determine their web server type (Apache, NGINX, or other). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today