Gravity Forms

Gravity Forms 3.1.0.4 and earlier is vulnerable to unauthenticated arbitrary file upload when a publicly accessible form contains a File Upload field whose visibility is set to Hidden. The issue is tracked as CVE-2026-84434. Wordfence rates it Critical, CVSS 9.8. Gravity Forms 3.1.1 contains the fix; site owners should install the latest available release (3.1.2 at the time of this advisory).

Exposure and technical cause

• Product: Gravity Forms WordPress plugin
• Affected versions: 3.1.0.4 and earlier
• Access required: None, if a vulnerable public form exists
• Required configuration: A File Upload field set to Hidden visibility
• Impact: Arbitrary file upload, potentially leading to remote code execution if a dangerous uploaded file can be executed by the server
• Fixed version: 3.1.1 and later

According to the Wordfence vulnerability record, a rejected upload can retain state that is later passed to the upload persistence path without sufficient revalidation. The flaw concerns the handling of hidden File Upload fields; it does not mean that every Gravity Forms installation is exploitable. Patchstack also lists the vulnerability and flags exploitation, though the public record does not establish a specific campaign affecting your site. This is distinct from earlier Gravity Forms file-upload advisories.

Fix and immediate containment

1. Update Gravity Forms to 3.1.1 or later from the vendor’s trusted update channel. The official changelog lists subsequent security-enhancement releases.
2. Until the update is installed, disable public forms with hidden File Upload fields or temporarily remove those fields. If that is impractical, disable the affected form or plugin.
3. After updating, review every public form’s File Upload fields and confirm only necessary upload destinations and file types remain enabled.
4. Investigate unexpected files before deleting them. Preserve a copy of suspicious files and relevant access logs if compromise is suspected.

Verify and investigate

Check the installed plugin version from the WordPress dashboard or WP-CLI:

wp plugin get gravityforms --fields=name,status,version,update --format=table

Review recent PHP-family files under uploads. This read-only check is only a starting point; a benign plugin may also write PHP files there.

find wp-content/uploads -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' \) -mtime -30 -print

Correlate unusual form submissions with subsequent requests to files in the uploads or Gravity Forms upload directories. Look for unexpected newly created administrator accounts, modified plugins, scheduled tasks, or outbound connections. If a suspicious file executed, treat the site as potentially compromised: isolate it, restore clean code from trusted sources, rotate credentials, and review logs and backups.

Defense in depth: block server-side script execution in upload directories at the web server. For an Apache deployment where .htaccess is honored, a directory-level rule such as the following can help; test it with your hosting configuration and do not treat it as a replacement for the plugin update:

<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

Sources

• Wordfence Intelligence: CVE-2026-84434
• Patchstack vulnerability record
• Gravity Forms official changelog