Unauthenticated arbitrary file upload via hidden file field in Gravity Forms leads to RCE (CVE-2026-84434)
VulnCheck added this flaw to its known-exploited catalog on 2026-09-18, the day the fix shipped, and any WordPress site with a Gravity Forms form containing a file upload field remains open to unauthenticated webshell upload until it is updated.
Gravity Forms up to 3.1.0.4 validates file extensions in one pipeline but persists uploads in another, so a hidden file upload field's rejected file is still passed to upload_file() without re-validation. An unauthenticated visitor can upload an executable file to the site and run code on the web server.
Affected: Gravity Forms (WordPress plugin) <= 3.1.0.4
How to Test
In WordPress admin, check Plugins for the Gravity Forms version; anything at or below 3.1.0.4 is vulnerable. Identify forms that contain a file upload field (the exploit requires one). Review the Gravity Forms upload directory and the web server's writable directories for recently added files with executable extensions (e.g. .php) and check access logs for unauthenticated POST submissions to those forms followed by direct requests to uploaded file paths.
How to Patch
Update Gravity Forms to 3.1.1 (the patched version per Patchstack). If the update must wait, remove or disable file upload fields on publicly reachable forms.