Executive brief
Gravity Forms is a popular plugin for creating and managing web forms in WordPress. A vulnerability allows unauthenticated attackers to upload malicious files (PHP or HTML) to a public directory when a form includes a multi-file upload field, potentially leading to unauthorized code execution or stored malware attacks. This affects all versions up to and including 3.0.2; version 3.0.3+ and newer are patched.
Technical details
The vulnerability exists in the GFAsyncUpload::upload() function due to insufficient validation of multi-file upload chunk state. Attackers can exploit this by reusing public form state URL hashes as chunk continuation hashes and injecting attacker-controlled temporary filenames that bypass sanitization. When a public form contains a File Upload field with "Multiple Files" enabled, an unauthenticated attacker can upload a PNG/PDF polyglot file to an attacker-selected .php or .html filename in the plugin's temporary upload directory. On non-.htaccess-respecting web servers (such as NGINX), this results in remote code execution; on Apache with .htaccess present, stored cross-site scripting (XSS) becomes the primary risk. The attack requires no authentication and can be performed against any WordPress site using the vulnerable plugin versions.
Affected products
- Rocketgenius Gravity Forms up to and including 3.0.2
Timeline
- 2026-09-01: disclosed
- 2026-08-25: patched: Patched in version 3.1.0; also patched in 3.0.3