A critical flaw in the Gravity Forms plugin for WordPress (versions up to and including 3.1.0.4) lets unauthenticated attackers upload executable files through hidden File Upload fields, opening the door to remote code execution.
What Is It
CVE-2026-84434 is an arbitrary file upload vulnerability (CWE-434) in the Gravity Forms plugin for WordPress, reachable via the upload_file function. Based on the available advisory descriptions, the flaw appears to stem from a gap between the field validation pipeline and the file persistence pipeline: hidden file upload fields are reported to bypass extension validation, with the upload state of a rejected file subsequently reaching upload_file() without re-validation. The internal mechanics have not been independently confirmed, but the reported outcome is that a file the plugin treated as rejected can still be written to disk.
The NVD record lists a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact. Because the record is still in Received status and has not completed NVD analysis, this score should be treated as provisional and subject to revision.
Why It Matters
Per the advisory, an attacker needs no account and no user interaction. Any publicly accessible form that meets the trigger condition can be used to place a file that may be executable on the server, which would make remote code execution possible. On a typical WordPress deployment that would mean full site compromise from an anonymous HTTP request.
The attack path is a normal, public-facing form submission, exactly the kind of traffic most sites expect to receive, and Gravity Forms is a commercial WordPress forms plugin whose install base is not published in the sources below.
What's Vulnerable
- Vendor/Product: Gravity Forms (WordPress plugin)
- Affected versions: all versions up to and including 3.1.0.4
- Exploitation prerequisite: the targeted form must contain a File Upload field with its Visibility set to "Hidden." Any publicly accessible form meeting that condition is reachable by unauthenticated attackers.
Administrators should audit their forms for hidden File Upload fields to identify exposed surface.
Patch Status
The NVD record is in Received status (published 2026-09-19) and lists no fixed version. Administrators should consult the Gravity Forms change log below for current release information and apply the latest available version of the plugin. Until a fix is confirmed, the practical mitigation is to remove or unhide File Upload fields on publicly reachable forms, since the hidden-field configuration is reported to be what makes the flaw exploitable.
Exploitation status for this CVE should be checked directly against the CISA Known Exploited Vulnerabilities catalog, which is the authoritative record for confirmed in-the-wild exploitation and federal remediation deadlines.
Sources
- NVD, CVE-2026-84434: https://nvd.nist.gov/vuln/detail/CVE-2026-84434
- Gravity Forms Change Log: https://docs.gravityforms.com/gravityforms-change-log/
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/787e22a9-329b-4e71-bc2a-4f5524fc9356?source=cve
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog