CVE-2026-84434: Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to uploadfile() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravity Forms (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.1.0.4 - Configuration
Ensure any File Upload field used on publicly accessible forms is not set to Visibility='Hidden' (hidden file upload fields bypass extension validation and enable unauthenticated arbitrary file upload up to 3.1.0.4).
Gravity Forms (WordPress plugin) File Upload field Visibility = Not 'Hidden' - Compensating control
Restrict access to publicly accessible forms that contain a File Upload field with Visibility set to 'Hidden' so unauthenticated attackers cannot reach them (the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition).
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated exploitation?
A site is exposed if it runs Gravity Forms 3.1.0.4 or an earlier version and has a publicly accessible form containing a File Upload field whose Visibility is set to Hidden. No account or other privileges are required.
What should administrators check while waiting to update?
Review publicly accessible Gravity Forms forms for File Upload fields configured as Hidden. Removing those hidden upload fields or making the affected forms inaccessible to unauthenticated users eliminates the stated exploitation path.
What could successful exploitation allow?
An attacker may upload files that are executable because the hidden field path bypasses extension validation. If an uploaded file can be executed, this can lead to remote code execution with high impact to confidentiality, integrity, and availability.