Threat Overview

Gravity Forms is an enterprise-grade form builder powering millions of contact forms, payment gateways, and custom workflow applications across commercial WordPress websites. A critical vulnerability tracked as CVE-2026-84434 allows unauthenticated visitors to bypass extension verification rules and upload arbitrary executable files directly to the web server via hidden file upload fields. Rated CVSS 9.8, this flaw gives remote attackers a direct mechanism to achieve remote code execution and seize complete administrative control.

Threat Metric Technical Details
Severity Rating CRITICAL (CVSS 9.8 / 10.0)
Vulnerability Class Unrestricted Upload of File with Dangerous Type (CWE-434)
Vulnerable Components Gravity Forms plugin, all versions up to and including 3.1.0.4
Attack Vector Unauthenticated HTTP POST submission containing manipulated hidden upload parameters
Exploitation Status Disclosed by security researchers; patch released; automated exploitation targeting forms underway
Fixed Version 3.1.1

The Breakdown: How the Exploit Works

The vulnerability stems from improper validation handling when processing multi-part form submissions containing hidden file upload fields.

When a public user submits a form, Gravity Forms evaluates field definitions to enforce permitted file extension restrictions. However, for certain dynamically generated or hidden upload fields, the validation handler fails to sanitize user-supplied file extensions before writing temporary upload files to the hosting filesystem.

An unauthenticated attacker constructs a multipart request that targets these unvalidated parameters, uploading a script carrying executable PHP directives disguised with double extensions or nested MIME types. Because the file lands in an executable web-accessible directory without extension stripping, the attacker can request the file directly through their browser, executing arbitrary code on the server.

The Operational Risk: What an Attacker Gains

Contact and lead capture forms are intentionally placed on public-facing pages to invite customer inquiries. This vulnerability turns a standard lead generation form into an unrestricted entry gate.

Once the malicious script executes, attackers gain full access to the hosting account. They can dump customer database tables, steal proprietary business data, inject malicious SEO spam links into published content, or pivot across shared hosting environments to compromise adjacent client properties.

Our Take in Plain English

“A contact or inquiry form on your website has one core duty: safely transport a customer’s message to your inbox. On legacy WordPress sites, processing an uploaded document requires opening a dynamic writable folder on your live production server. When that validation logic fails, the server itself is compromised. Modern pre-rendered architecture completely decouples form processing from website hosting, routing submissions through isolated serverless edge endpoints where rogue server uploads are physically impossible.”

The Modern Architectural Remedy

  • Legacy Dynamic Platform: Processes file uploads through shared server directories with executable permissions, exposing the host whenever plugin-level sanitization fails.
  • Modern Pre-Rendered Architecture: Delivers read-only compiled static assets globally while processing form data via isolated, decoupled serverless edge functions with zero local file execution.

Immediate Action Items for WordPress Operators

  1. Update Immediately: Upgrade Gravity Forms to version 3.1.1 or later across all active sites.
  2. Review Upload Directories: Inspect the /wp-content/uploads/ directory hierarchy for suspicious .php, .phtml, or executable files.
  3. Disable Script Execution in Uploads: Configure web server rules (such as .htaccess or Nginx directives) to deny script execution inside upload folders.
  4. Audit Form Configurations: Review active forms and temporarily disable file upload fields that are not strictly necessary until updates are confirmed.