---
id: CVE-2026-84434
title: >-
  The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload
  in all versions up to, and including, 3.1.0.4 via the upload_file function
summary: >-
  The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload
  in all versions up to, and including, 3.1.0.4 via the upload_file function.
  This is due to a mismatch between the field validation pipeline and the file
  persis…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-434
vendor: Gravity Forms
product: Gravity Forms
affected:
  - gravity_forms <= 3.1.0.4
published: '2026-09-19'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T13:33:33.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84434'
references:
  - url: 'https://docs.gravityforms.com/gravityforms-change-log/'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/787e22a9-329b-4e71-bc2a-4f5524fc9356?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.0391
epssPercentile: 0.89905
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/murrez/CVE-2026-84434'
  nuclei:
    - CVE-2026-84434
  checkedAt: '2026-09-26T09:06:02.620Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-19T13:22:34.707717Z'
ingestedAt: '2026-09-19T02:56:32.978Z'
---

## Overview

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.