Gravity Forms multi-file uploads permit unauthenticated dangerous file placement
Gravity Forms through 3.0.2 insufficiently validates multi-file upload chunk state in GFAsyncUpload::upload(). On a public form with Multiple Files enabled, an unauthenticated attacker can reuse a public form-state URL hash as a continuation hash and supply a temporary filename, placing a valid PNG or PDF polyglot at an attacker-selected public .php or .html name in the temporary upload directory. This can lead to remote code execution on NGINX or other servers that do not honor the directory's .htaccess protection; where PHP execution is blocked, attacker-written HTML can produce same-origin stored cross-site scripting when its URL is visited.
- Component
- Gravity Forms
- Plugin slug
gravity-forms- Affected
- <= 3.0.2
- Safe version
- See mitigation notes
- Published
- Sep 01, 2026
This CVE was published Sep 01, 2026 and is one of 15 known issues for this plugin.
Update, patch or deactivate.
Update to a confirmed release newer than 3.0.2 when available. Until then, disable public multi-file uploads when warranted, prevent script execution in Gravity Forms temporary uploads at the web-server level, inspect temporary upload files, and review the site for unauthorized code.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This makes it possible for unauthenticated attackers, when a public form contains a File Upload field with Multiple Files enabled, to upload a valid PNG/PDF polyglot to an attacker-selected public `.php` or `.html` filename in the Gravity Forms temporary upload directory. This can lead to remote code execution on WordPress systems that use NGINX or other non `.htaccess` respecting web servers. NOTE: During installation and activation, the Gravity Forms plugin places a `.htaccess` file in this directory, which prevents this vulnerability from being exploited despite the PHP file being written to the temporary upload directory. In these cases where PHP execution is blocked, attacker-written HTML can result in stored same-origin cross-site scripting if a victim visits the generated file URL.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H