CVE-2026-19513: Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the GFAsyncUpload::upload() function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This makes it possible for unauthenticated attackers, when a public form contains a File Upload field with Multiple Files enabled, to upload a valid PNG/PDF polyglot to an attacker-selected public .php or .html filename in the Gravity Forms temporary upload directory. This can lead to remote code execution on WordPress systems that use NGINX or other non .htaccess respecting web servers. NOTE: During installation and activation, the Gravity Forms plugin places a .htaccess file in this directory, which prevents this vulnerability from being exploited despite the PHP file being written to the temporary upload directory. In these cases where PHP execution is blocked, attacker-written HTML can result in stored same-origin cross-site scripting if a victim visits the generated file URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravity Forms (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.0.2
Event History
Frequently Asked Questions
Which deployments are most exposed to remote code execution?
A deployment needs a publicly accessible Gravity Forms form with a File Upload field configured for Multiple Files. Remote code execution is possible where the temporary upload directory permits PHP execution, such as on NGINX or other servers that do not honor .htaccess rules.
Does the plugin's temporary-upload .htaccess file eliminate the risk?
When the .htaccess file installed by Gravity Forms is present and enforced, it prevents PHP execution from the temporary upload directory and blocks the remote-code-execution outcome. It does not fully eliminate impact: attacker-written HTML may enable stored same-origin cross-site scripting if someone visits the generated file URL.
What can be checked to determine whether a site is affected?
Confirm whether the installed Gravity Forms version is 3.0.2 or earlier and whether any public form enables Multiple Files on a File Upload field. Also determine whether the web server enforces the temporary upload directory's .htaccess protections or otherwise allows PHP execution there.