EUVD-2026-83472
GHSA-x9x4-5g6j-pvj3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote upload-to-RCE gives full C/I/A, but the required non-default 'Hidden' File Upload field is a target-state precondition outside attacker control, justifying AC:H over the vendor's AC:L.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
Articles & Coverage 1
AnalysisAI
Unauthenticated arbitrary file upload in the Gravity Forms WordPress plugin through version 3.1.0.4 can lead to remote code execution on any site whose publicly reachable form contains a File Upload field with its Visibility set to 'Hidden', because hidden upload fields skip the extension-validation step and a rejected file's intact upload state is subsequently persisted by upload_file() without re-validation. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), no credentials or user interaction are required (PR:N/UI:N) and the attack is fully remote (AV:N), but the non-default hidden File Upload field is a mandatory precondition; a secondary practical limiter is that code execution depends on the server actually executing the uploaded file type in the upload directory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the targeted Gravity Forms form to contain a File Upload field with its Visibility set to 'Hidden' on a publicly accessible form; without such a field the flaw is not reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue by every available signal, with one important real-world caveat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Gravity Forms to the latest release, verifying the fixed build via the vendor change log at https://docs.gravityforms.com/gravityforms-change-log/ - the provided data does not name a specific patched version, so treat the most recent release as the remediation target and confirm the fix note before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations running Gravity Forms through version 3.1.0.4, identify any publicly reachable forms that include a File Upload field with Visibility set to 'Hidden', and immediately remove that field, change its visibility, disable the affected form, or deactivate the Gravity Forms plugin where it is not business-critical; additionally, block PHP execution in wp-content/uploads via web server configuration and deploy WAF rules to block file-upload requests to Gravity Forms endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gravity Forms
View allThe Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message
The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, lea
Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Rated high severity (CVSS 8.3), this vulnerability
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PH
Arbitrary file disclosure in the Gravity Forms WordPress plugin (all versions through 2.10.4) lets unauthenticated attac
Stored Cross-Site Scripting in the Gravity Forms WordPress plugin (all versions ≤2.10.5) permits unauthenticated attacke
Stored cross-site scripting (XSS) in Gravity Forms WordPress plugin versions ≤2.10.0 allows remote unauthenticated attac
Stored Cross-Site Scripting in Gravity Forms plugin for WordPress through version 2.10.0 allows unauthenticated remote a
Stored XSS in Gravity Forms for WordPress ≤2.10.0 allows unauthenticated remote attackers to inject malicious JavaScript
Stored Cross-Site Scripting in Gravity Forms for WordPress up to 2.10.0 enables unauthenticated attackers to inject mali
Stored Cross-Site Scripting in Gravity Forms plugin for WordPress allows unauthenticated remote attackers to inject mali
Share
External POC / Exploit Code
Leaving vuln.today