Gravity Forms: Unauthenticated Arbitrary File Upload via Multi-Chunk State

Threat Overview

A high-severity arbitrary file upload vulnerability in the Gravity Forms plugin allows unauthenticated attackers to upload malicious files to the server’s temporary upload directory. Caused by insufficient validation of multi-file upload chunk states, the flaw permits attackers to manipulate temporary file extensions, creating serious remote code execution risks on NGINX and non-Apache web architectures.

The Breakdown: How the Exploit Works

Gravity Forms uses asynchronous chunking routines in GFAsyncUpload::upload() to support multi-file uploads from public-facing forms. When a visitor attaches large files, the form splits the payload into discrete chunks before assembling the final file on the server.

The vulnerability stems from the plugin’s failure to properly isolate chunk continuation hashes from public form state identifiers. Unauthenticated attackers can reuse valid form state hashes to bypass file-type validation rules and supply arbitrary temporary file names before sanitization runs. This allows the attacker to upload polyglot files (valid image formats containing executable PHP or HTML payloads) with attacker-selected .php or .html filenames into the temporary storage directory. On web servers such as NGINX that do not honor .htaccess execution restrictions, these uploaded files can be directly requested and executed via public URLs.

The Operational Risk: What an Attacker Gains

The impact of this flaw depends on the server environment hosting the WordPress site:

• Remote Code Execution (NGINX/Edge Servers): On servers where directory-level script execution is not blocked by native server configurations, attackers execute arbitrary PHP commands to achieve full server control.
• Persistent Stored Cross-Site Scripting (XSS): Even on systems where PHP execution is prevented, attackers can deposit malicious HTML files to steal session cookies and redirect visitors to phishing sites.

Our Take in Plain English

“Form plugins are essential for lead generation, but processing complex asynchronous file uploads directly inside an active dynamic server creates high-risk edge cases. If server-level directory protections do not match plugin assumptions, a minor parsing loophole turns public contact forms into backdoor delivery systems. By utilizing modern pre-rendered edge architecture with decoupled cloud form processing, file uploads are handled entirely in sandboxed storage pipelines with zero executable server scripts.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: Accepts raw multi-part file uploads directly into web-accessible server directories, relying on fragile software-level file inspection to block executable scripts.
• Modern Pre-Rendered Architecture: Processes contact forms and user submissions through isolated, serverless endpoints. Uploaded assets are routed directly to private, immutable object storage buckets with zero script execution capabilities.

Immediate Action Items for WordPress Operators

1. Update Gravity Forms: Upgrade the Gravity Forms plugin to version 3.0.3 or higher immediately.
2. Review NGINX Configuration: For sites hosted on NGINX, ensure upload and temporary directories explicitly deny execution of .php, .phtml, and executable script extensions.
3. Audit Temporary Folders: Inspect the /wp-content/uploads/gravity_forms/ directory for unexpected HTML or PHP files.