CVE-2026-84434: Gravity Forms WordPress Plugin RCE Vulnerability

CVE-2026-84434 Overview

The Gravity Forms plugin for WordPress contains an arbitrary file upload vulnerability affecting all versions up to and including 3.1.0.4. The flaw resides in the upload_file function and stems from a validation pipeline mismatch. Hidden file upload fields bypass extension validation, and the intact upload state of a rejected file is later passed to upload_file() without re-validation. Unauthenticated attackers can upload executable files, enabling remote code execution on affected WordPress installations. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to Hidden. Any publicly accessible form meeting this condition is reachable by remote attackers without credentials or user interaction.

Critical Impact
Unauthenticated remote attackers can upload executable files to vulnerable WordPress sites, achieving remote code execution and full site compromise.

Affected Products

Gravity Forms plugin for WordPress, all versions through 3.1.0.4
WordPress sites hosting publicly accessible forms with Hidden File Upload fields
Any WordPress deployment where administrators have configured hidden upload fields for asset collection workflows

Discovery Timeline

2026-09-19 - CVE-2026-84434 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-84434

Vulnerability Analysis

The vulnerability is classified as Unrestricted Upload of File with Dangerous Type [CWE-434]. Gravity Forms implements two separate pipelines for handling file uploads: a field validation pipeline and a file persistence pipeline. These pipelines do not enforce consistent state, allowing a rejected file to remain available to the persistence stage.

When a form contains a File Upload field with Visibility set to Hidden, the extension validation logic treats the field as out of scope. The rejected file's intact upload state is subsequently handed to upload_file() without a second validation pass. The persistence stage then writes the attacker-controlled file to disk under a name and extension the attacker controls.

Because Gravity Forms is a widely deployed commercial WordPress plugin, the attack surface is broad. Successful exploitation yields code execution in the web server context, which typically enables database theft, credential harvesting, and lateral movement into adjacent hosts.

Root Cause

The root cause is a broken invariant between validation and persistence. Hidden fields skip extension checks, and the persistence layer trusts prior validation state instead of re-verifying the file type before writing it to the uploads directory.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker identifies a publicly reachable Gravity Forms form containing a Hidden File Upload field, then submits a crafted multipart request referencing that hidden field with an executable payload such as a PHP file. The plugin persists the file to a web-accessible path, and the attacker requests the uploaded file directly to trigger code execution.

No verified proof-of-concept code has been published. For technical details, see the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-84434

Indicators of Compromise

Unexpected files with executable extensions such as .php, .phtml, or .phar in the Gravity Forms uploads directory, typically wp-content/uploads/gravity_forms/
POST requests to admin-ajax.php or Gravity Forms endpoints referencing hidden field identifiers with attached file payloads
Web server access log entries showing GET requests directly targeting files inside the Gravity Forms upload path
New WordPress administrator accounts, plugin installations, or theme modifications following anomalous upload traffic

Detection Strategies

Audit all Gravity Forms configurations for File Upload fields with Visibility set to Hidden on publicly reachable forms
Deploy web application firewall (WAF) rules that inspect multipart uploads targeting Gravity Forms endpoints and block dangerous extensions
Correlate upload requests with subsequent direct file access requests in a short time window to identify exploitation sequences

Monitoring Recommendations

Monitor filesystem changes in wp-content/uploads/ for newly created files with server-executable extensions
Alert on outbound network connections originating from the PHP-FPM or web server process that fall outside normal application behavior
Track child processes spawned by the web server user, which typically indicates post-exploitation activity such as reverse shells or reconnaissance commands

How to Mitigate CVE-2026-84434

Immediate Actions Required

Update the Gravity Forms plugin to a version above 3.1.0.4 as soon as the vendor patch is available, per the Gravity Forms Change Log
Inventory every form and disable or remove File Upload fields whose Visibility is set to Hidden until patching completes
Review Gravity Forms upload directories for unfamiliar files and remove any suspicious artifacts after forensic capture

Patch Information

Gravity Forms addresses the flaw in releases published after version 3.1.0.4. Site administrators should consult the Gravity Forms Change Log for the fixed version number and apply the update through the WordPress plugin manager or by deploying the vendor-provided package.

Workarounds

Temporarily remove File Upload fields with Hidden visibility from all active forms until the plugin is updated
Configure the web server to deny execution of PHP and other script types within the wp-content/uploads/ directory tree
Restrict access to Gravity Forms submission endpoints using WAF rules or IP allowlists where public submission is not required

bash

# Apache configuration example: block script execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    php_flag engine off
    <FilesMatch "\.(php|phtml|phar|php7|pht)$">
        Require all denied
    </FilesMatch>
</Directory>