CVE-2026-84434criticalobserved exploitationCWE-434

CVE-2026-84434: critical vulnerability in Gravity Forms

Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field

Published

Follow this CVE+ Monitor Gravity Forms

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 3.9%
from disclosure to weaponsame day
Published on NVDSep 19
1st PoCSep 19
VulnCheckSep 18
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Gravity Forms · Gravity Forms
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Gravity Forms

In the same product, most dangerous first.

CVE-2025-12352CRITICALGravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'EPSS 1.1%CVE-2026-12997HIGHGravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' ParameterEPSS 0.9%CVE-2025-12974HIGHGravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked UploadEPSS 0.7%CVE-2026-19513HIGHGravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash ConfusionEPSS 0.7%CVE-2026-103039CRITICALGravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom FieldEPSS 0.5%CVE-2026-4406MEDIUMGravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' ParameterEPSS 0.4%