{"id":"CVE-2026-84434","aliases":["EUVD-2026-83472","GHSA-x9x4-5g6j-pvj3"],"status":"published","title":"Gravity Forms \u003c= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field","description":"The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0391,"percentile":0.90439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2026-09-19T02:27:09Z","modified":"2026-09-21T13:33:33Z","exploits":[{"source":"nuclei","id":"CVE-2026-84434","title":"WordPress Gravity Forms Plugin \u003c=3.1.0.4 - Unauthenticated Arbitrary File Upload","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-84434.yaml"},{"source":"pocgithub","id":"murrez/CVE-2026-84434","title":"murrez/CVE-2026-84434","date":"2026-09-19","url":"https://github.com/murrez/CVE-2026-84434"}],"products":[{"vendor":"gravity forms","product":"gravity forms"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/787e22a9-329b-4e71-bc2a-4f5524fc9356?source=cve"},{"url":"https://docs.gravityforms.com/gravityforms-change-log/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84434"},{"url":"https://docs.gravityforms.com/gravityforms-change-log"},{"url":"https://github.com/advisories/GHSA-x9x4-5g6j-pvj3"}],"sources":{"cve":[{"id":"CVE-2026-84434","title":"Gravity Forms \u003c= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field","description":"The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.","status":"published","published":"2026-09-19T02:27:09.915Z","modified":"2026-09-19T14:01:26.965Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-83472","description":"The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.","status":"published","published":"2026-09-19T02:27:09Z","modified":"2026-09-19T14:01:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:06.658724Z"}],"ghsa":[{"id":"GHSA-x9x4-5g6j-pvj3","title":"The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up...","description":"The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.","status":"published","published":"2026-09-19T03:32:02Z","modified":"2026-09-19T03:32:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:12:13.368323Z"}],"nvd":[{"id":"CVE-2026-84434","description":"The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.","status":"published","published":"2026-09-19T03:17:15.573Z","modified":"2026-09-21T13:33:33.387Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:50.043898Z"}]}}