CVE-2026-19513: Gravity Forms WordPress Plugin RCE Vulnerability

CVE-2026-19513 Overview

The Gravity Forms plugin for WordPress contains an arbitrary file upload vulnerability affecting all versions up to and including 3.0.2. The flaw resides in the GFAsyncUpload::upload() function, which insufficiently validates multi-file upload chunk state. Public form state URL hashes can be reused as chunk continuation hashes, and attacker-controlled temporary filenames are accepted before sanitization. Unauthenticated attackers can upload a PNG/PDF polyglot to an attacker-chosen .php or .html filename in the Gravity Forms temporary upload directory when a public form exposes a File Upload field with Multiple Files enabled. The issue is tracked as CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Unauthenticated attackers can achieve remote code execution on WordPress systems running NGINX or other web servers that do not honor .htaccess, and stored same-origin cross-site scripting where PHP execution is blocked.

Affected Products

Gravity Forms plugin for WordPress, all versions through 3.0.2
WordPress sites served by NGINX or other web servers that do not process .htaccess directives
Any WordPress deployment where the Gravity Forms temporary upload directory lacks enforced execution restrictions

Discovery Timeline

2026-09-01 - CVE-2026-19513 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-19513

Vulnerability Analysis

The vulnerability originates in Gravity Forms' asynchronous chunked upload handler. The GFAsyncUpload::upload() function accepts multi-file upload continuations without adequately distinguishing between public form state hashes and internal chunk continuation hashes. Because public form state URL hashes are reusable as chunk continuation identifiers, an unauthenticated attacker can bootstrap a valid upload session against any public form that exposes a File Upload field with Multiple Files enabled.

Once the session is established, the handler reads the attacker-supplied temporary filename before applying sanitization. This ordering flaw allows attackers to specify arbitrary filenames, including those with .php or .html extensions. A crafted PNG/PDF polyglot passes the plugin's content validation checks while remaining executable as PHP or renderable as HTML when served directly by the web server.

Root Cause

The root cause is improper state validation combined with pre-sanitization filename trust. The upload handler does not enforce a strict separation between public-facing hashes and internal chunk identifiers, and it accepts client-controlled filename input before rejecting dangerous extensions. This maps directly to CWE-434, unrestricted upload of file with dangerous type.

Attack Vector

An unauthenticated attacker locates any public Gravity Forms form containing a File Upload field with Multiple Files enabled. The attacker extracts the form state hash from the public page, reuses it as a chunk continuation hash, and submits a polyglot file with an attacker-selected .php or .html filename. On NGINX and similar servers that ignore .htaccess, requesting the resulting URL executes the uploaded PHP. On Apache installations where the plugin's .htaccess blocks PHP execution, the same primitive yields stored same-origin cross-site scripting through the HTML variant.

No verified public exploit code has been released. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-19513

Indicators of Compromise

Files with .php, .phtml, or .html extensions present in the Gravity Forms temporary upload directory, typically under wp-content/uploads/gravity_forms/tmp/
POST requests to admin-ajax.php with action=gf_async_upload containing unexpected original_filename or name parameters ending in executable extensions
Multiple chunked upload requests originating from unauthenticated sessions targeting the same form hash
Web server access logs showing GET requests to attacker-named files within the Gravity Forms tmp directory

Detection Strategies

Inspect the Gravity Forms temporary upload directory for any file whose extension is not on an approved allowlist such as .tmp, .jpg, .png, or .pdf
Alert on requests to gf_async_upload where the submitted filename contains double extensions or executable suffixes
Correlate high-volume chunked upload activity from a single source IP against multiple form endpoints
Verify the presence and integrity of the .htaccess file that Gravity Forms places in the temporary upload directory during installation

Monitoring Recommendations

Enable web application firewall logging for all Gravity Forms AJAX endpoints and forward events to a centralized data lake
Monitor file system change events on wp-content/uploads/gravity_forms/tmp/ for creation of executable file types
Track HTTP responses that serve content types text/html or application/x-httpd-php from within upload directories
Review NGINX and reverse proxy configurations for locations that pass .php requests within upload paths to PHP-FPM

How to Mitigate CVE-2026-19513

Immediate Actions Required

Update Gravity Forms to the patched release immediately per the Gravity Forms Change Log
Audit all public forms containing File Upload fields with Multiple Files enabled and disable the setting where not required
Inspect the Gravity Forms temporary upload directory and remove any files with executable or HTML extensions
Confirm that a valid .htaccess file exists in the temporary upload directory and that the web server honors it, or apply an equivalent server-level restriction

Patch Information

Gravity Forms has released a fixed version addressing the chunk state validation and filename sanitization logic in GFAsyncUpload::upload(). Consult the Gravity Forms Change Log for the exact patched version and upgrade path. The Wordfence Vulnerability Report provides additional remediation context.

Workarounds

On NGINX, add a location block that denies execution and returns 403 for any request matching the Gravity Forms temporary upload path
Deploy a web application firewall rule blocking gf_async_upload requests whose filename parameter contains .php, .phtml, .html, or double extensions
Restrict the Gravity Forms temporary directory to non-executable MIME types at the reverse proxy layer
Temporarily disable Multiple Files on all publicly accessible File Upload fields until patching is complete

bash

# NGINX configuration example: block execution in Gravity Forms tmp directory
location ~* /wp-content/uploads/gravity_forms/tmp/ {
    location ~ \.(php|phtml|phar|html?)$ {
        deny all;
        return 403;
    }
}