WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload
CVE-2026-84434
Verified
Description
Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticated arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields. Unauthenticated attackers can upload any file type including PHP when a form has a File Upload field configured with Hidden visibility. The bypass works because the server-side extension validation is skipped for fields with gfield_visibility_hidden CSS class.
Severity
Critical
CVSS Score
9.8
Exploit Probability
4%
Affected Product
gravityforms
Published Date
September 21, 2026
Template Author
dhiyaneshdk
CVE-2026-84434.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-84434
CWE ID:
cwe-434
References
https://github.com/murrez/CVE-2026-84434https://patchstack.com/database/wordpress/plugin/gravityforms/vulnerability/wordpress-gravity-forms-plugin-3-1-0-4-unauthenticated-arbitrary-file-upload-via-hidden-file-upload-field-vulnerabilityhttps://www.wordfence.com/threat-intel/vulnerabilities/id/787e22a9-329b-4e71-bc2a-4f5524fc9356https://docs.gravityforms.com/gravityforms-change-log/
Remediation Steps
Update Gravity Forms to version 3.1.1 or later.