CVE-2026-84434
published 2026-09-19CVE-2026-84434: The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This…
PriorityP186critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
3.91%
90.2th percentile
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gravity_forms | gravity_forms | <= 3.1.0.4 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function.
ghsa_unreviewed·2026-09-19
CVE-2026-84434 [CRITICAL] CWE-434 The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function.
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
VulnCheck
Vulnerability
vulncheck·2026
CVE-2026-84434 Vulnerability
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://patchstack.com/database/wordpress/plugin/gravityforms/vulnerability/wordpress-gravity-forms-plugin-3-1-0-4-unauthenticated-arbitrary-file-upload-via-hidden-file-upload-field-vulnerability
No detection rules found.
Nuclei
WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload
nuclei·CVSS 9.8
CVE-2026-84434 [CRITICAL] WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload
WordPress Gravity Forms Plugin ]*>[\s\S]{0,800}?name=["''](input_[0-9]+(?:_[0-9]+)?)["''][^>]*type=["'']file["'']'
- 'gfield_visibility_hidden[^>]*>[\s\S]{0,800}?type=["'']file["''][^>]*name=["''](input_[0-9]+(?:_[0-9]+)?)["'']'
- type: regex
name: form_unique_id
part: body
internal: true
group: 1
regex:
- 'name=["'']gform_unique_id["''][^>]*value=["'']([^"'']*)["'']'
- type: regex
name: gform_ajax_value
part: body
internal: true
group: 1
regex:
- 'name=["'']gform_ajax["''][^>]*value=["'']([^"'']*)["'']'
- id: submit-page
raw:
- |
POST {{BaseURL}}{{found_page_path}} HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----{{boundary}}
Referer: {{BaseURL}}{{found_page_path}}
Origin: {{RootURL}}
------{{boundary}}
Content-Disposition: form-data; name="is_submit_{{form_
No writeups or analysis indexed.
2026-09-19
Published
Exploited in the wild