CVE-2026-84434

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.1.1

Description An arbitrary file upload issue exists in the Gravity Forms plugin for WordPress via the upload file() function. The flaw stems from a mismatch between the field validation pipeline and the file persistence pipeline, allowing hidden file upload fields to bypass extension validation. Consequently, a rejected file's intact upload state can be passed to upload file() without re-validation. This allows unauthenticated attackers to upload executable files on any publicly accessible form where a File Upload field has its Visibility set to 'Hidden', potentially leading to remote code execution (RCE), which is the ability to execute arbitrary commands on the server.

Recommendations Update to version 3.1.1. As a temporary workaround, ensure no File Upload fields have their Visibility set to 'Hidden' on publicly accessible forms.