CVE-2026-19513

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.0.3

Description An arbitrary file upload issue exists affecting over 1 million WordPress installations. The flaw originates from insufficient validation of the multi-file upload chunk state within the GFAsyncUpload::upload() function. Specifically, a cryptographic domain-confusion flaw occurs because wp hash() is reused without context separation for both public form state and chunk-continuation authentication, allowing attackers to reuse a legitimate URL hash to authenticate malicious upload requests. Unauthenticated attackers can exploit this when a public form has a File Upload field with Multiple Files enabled by uploading a PNG or PDF polyglot—a file that is valid in two different formats—to a filename of their choice, such as .php or .html, in the temporary upload directory. This can lead to remote code execution on systems using NGINX or other web servers that do not respect .htaccess files. On servers where PHP execution is blocked, such as Apache, uploading an HTML file can result in stored same-origin cross-site scripting (XSS), which occurs when a malicious script is permanently stored on the server and executed in the victim's browser.

Recommendations Update Gravity Forms to a version newer than 3.0.2. As a temporary mitigation, disable the Multiple Files option in File Upload fields on all public forms.