CVE-2026-84434 Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Unauthenticated attackers can upload executable files via hidden fields in Gravity Forms, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84434?
CVE-2026-84434 is a critical vulnerability in Gravity Forms, published on 19 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
Weakness: CWE-434
Which versions are affected by CVE-2026-84434?
How do I fix CVE-2026-84434?
No fix has been published for CVE-2026-84434 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-84434 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84434 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-x9x4-5g6j-pvj3.