# CVE-2026-19513: Gravity Forms arbitrary file upload via multi-file chunk state

Source: https://junglewise.ai/threats/cve-2026-19513-gravity-forms-arbitrary-file-upload-via-multi-file-chunk-state  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19513 · Severity: high · CVSS 8.1 · Published 2026-09-01

Gravity Forms is a popular plugin for creating and managing web forms in WordPress. A vulnerability allows unauthenticated attackers to upload malicious files (PHP or HTML) to a public directory when a form includes a multi-file upload field, potentially leading to unauthorized code execution or stored malware attacks. This affects all versions up to and including 3.0.2; version 3.0.3+ and newer are patched.

Technologies: [Rocketgenius Gravity Forms](https://junglewise.ai/threats/technologies/gravity-forms). Vendors: [Rocketgenius](https://junglewise.ai/threats/vendors/rocketgenius).

## Quick answers

**Is CVE-2026-19513 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19513 being exploited in the wild.

**How severe is CVE-2026-19513?** High severity, with a CVSS score of 8.1, published 1 September 2026.

**Which products and versions are affected?** Rocketgenius Gravity Forms up to and including 3.0.2.

**Is there a fix for CVE-2026-19513?** A patch was published on 2026-08-25: Patched in version 3.1.0; also patched in 3.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19513 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-19513?** Check whether you run Rocketgenius Gravity Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the GFAsyncUpload::upload() function due to insufficient validation of multi-file upload chunk state. Attackers can exploit this by reusing public form state URL hashes as chunk continuation hashes and injecting attacker-controlled temporary filenames that bypass sanitization. When a public form contains a File Upload field with "Multiple Files" enabled, an unauthenticated attacker can upload a PNG/PDF polyglot file to an attacker-selected .php or .html filename in the plugin's temporary upload directory. On non-.htaccess-respecting web servers (such as NGINX), this results in remote code execution; on Apache with .htaccess present, stored cross-site scripting (XSS) becomes the primary risk. The attack requires no authentication and can be performed against any WordPress site using the vulnerable plugin versions.

## Affected products

- Rocketgenius Gravity Forms up to and including 3.0.2

## Timeline

- 2026-09-01: disclosed
- 2026-08-25: patched: Patched in version 3.1.0; also patched in 3.0.3

## References

- [https://docs.gravityforms.com/gravityforms-change-log/](https://docs.gravityforms.com/gravityforms-change-log/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/d20b2d00-054e-4772-a5a5-b7b33063043c?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/d20b2d00-054e-4772-a5a5-b7b33063043c?source=cve)

## Related threats

- [Gravity Forms plugin Stored Cross-Site Scripting in List Field](https://junglewise.ai/threats/cve-2026-97645-the-gravity-forms-plugin-for-wordpress-is-vulnerable-to-stored)
- [Gravity Forms plugin stored cross-site scripting in field values](https://junglewise.ai/threats/cve-2026-90437-the-gravity-forms-plugin-for-wordpress-is-vulnerable-to-stored)
- [Gravity Forms PHP Object Injection in Post Custom Field](https://junglewise.ai/threats/cve-2026-103039-the-gravity-forms-plugin-for-wordpress-is-vulnerable-to-php)
- [Gravity Forms PHP object injection vulnerability](https://junglewise.ai/threats/cve-2026-97296-deserialization-of-untrusted-data-vulnerability-in-rocketgenius)
- [Gravity Forms Directory Traversal in gform_uploaded_files parameter](https://junglewise.ai/threats/cve-2026-12997-gravity-forms-directory-traversal-in-gform-uploaded-files)