GravityExport Lite CVE-2026-94120

Requires only that the target WordPress site have GravityExport Lite for Gravity Forms at version 2.7.2 or earlier installed and reachable over the network; per AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special configuration prerequisite stated. The practical limiting factors are deployment-based rather than access-based: the plugin depends on the commercial Gravity Forms plugin being present, so its footprint is limited to Gravity Forms sites that also add this export extension, and the impact is confined to confidentiality (data disclosure of form/export data) with no integrity or availability effect.

The single strongest signal here is the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: fully remote, low-complexity, unauthenticated, no user interaction, with high confidentiality impact but zero integrity or availability effect. That profile - CWE-862 Missing Authorization causing pure data disclosure - is a credible real priority because an attacker needs nothing but network reach to a vulnerable site to read data that should be protected (typically Gravity Forms entry/export data). However, several risk-amplifying signals are absent: no EPSS score is provided, there is no CISA KEV listing, and no public proof-of-concept is referenced, so this is best characterized as no public exploit identified at time of analysis rather than active exploitation. The 7.5 base score is driven entirely by C:H with no integrity/availability impact, so it is a serious confidentiality/data-leak issue, not a site-takeover or RCE bug. Net: real and easily exploitable in principle (unauthenticated, network, low complexity), but current in-the-wild pressure is unquantified because EPSS/KEV/POC signals are all missing.

An unauthenticated remote attacker sends a crafted HTTP request to a WordPress site running GravityExport Lite for Gravity Forms <= 2.7.2, reaching an export/download endpoint that fails to verify authorization (CWE-862). Because no authentication or user interaction is required (PR:N/UI:N/AC:L), the attacker retrieves Gravity Forms entry or export data they should not be able to see, resulting in confidentiality-only disclosure (C:H, I:N, A:N). No public proof-of-concept is referenced, so exploitation would rely on independently identifying the unprotected endpoint.