CVE-2026-84434— Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Quick assessment
Affected
Gravity Forms Gravity Forms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Gravity Forms 插件存在任意文件上传漏洞，影响版本为 3.1.0.4 及之前的所有版本，漏洞通过 函数触发。该漏洞源于字段验证流程与文件持久化流程之间的不一致：隐藏的文件上传字段会绕过扩展名校验，而被拒绝的文件在保留其完整上传状态的情况下，随后被传入 时未再次进行校验。这使得未认证的攻击者能够上传可能是可执行文件的文件，从而可能导致远程代码执行。 漏洞利用的前提条件是：目标表单中必须包含一个“文件上传”字段，且其可见性设置为“隐藏”；对于满足此条件的任何公开可访问的表单，未认证的
Possible ATT&CK Techniques 1 AI
T1065.001
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84434
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Source: CVE Program / CVE List V5
Vulnerability Description
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Gravity Forms | Gravity Forms | 0 ~ 3.1.0.4 | - |
|
II. Public POCs for CVE-2026-84434
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84434
请登录查看更多情报信息。
Other References for CVE-2026-84434 (1)
IV. Related Vulnerabilities
Same product: Gravity Forms
-
CVE-2026-16649
Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site -
CVE-2026-19513
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Uplo -
CVE-2026-12997
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Rea -
CVE-2026-48866
WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File -
CVE-2026-5110
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site
Same vendor: Gravity Forms
-
CVE-2026-16649
Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site -
CVE-2026-19513
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Uplo -
CVE-2026-12997
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Rea -
CVE-2026-5110
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site -
CVE-2026-5111
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site
Same weakness: CWE-434
-
CVE-2026-93031
WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-D -
CVE-2026-77929
ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Uplo -
CVE-2026-56590
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-92980
HortusFox-Web < 6.1 Remote Code Execution via Import/Export -
CVE-2026-87935
Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Uplo
V. Comments for CVE-2026-84434
No comments yet