# CVE-2026-94120: GravityExport Lite for Gravity Forms broken access control

Source: https://junglewise.ai/threats/cve-2026-94120-unauthenticated-broken-access-control-in-gravityexport-lite-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-94120 · Severity: high · CVSS 7.5 · Published 2026-09-30

GravityExport Lite is a WordPress plugin that exports form submission data from Gravity Forms. An unauthenticated attacker can bypass access controls to view or export sensitive form data and responses belonging to other users. This could expose confidential information collected through contact forms, surveys, or applications.

Vendors: [Gravity Forms](https://junglewise.ai/threats/vendors/gravity-forms).

## Quick answers

**Is CVE-2026-94120 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94120 being exploited in the wild.

**How severe is CVE-2026-94120?** High severity, with a CVSS score of 7.5, published 30 September 2026.

**Which products and versions are affected?** Gravity Forms GravityExport Lite 2.7.2 and earlier.

**Is there a fix for CVE-2026-94120?** A patch was published on 2026-09-28: Version 2.7.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94120 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-94120?** Check whether you run Gravity Forms GravityExport Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Broken access control vulnerability in GravityExport Lite for Gravity Forms allows unauthenticated attackers to access restricted functionality without proper authorization checks. The vulnerability requires only network access with no authentication or user interaction. An attacker can retrieve and export form submission data that should be restricted to authorized users.

## Affected products

- Gravity Forms GravityExport Lite 2.7.2 and earlier

## Timeline

- 2026-09-28: disclosed
- 2026-09-28: patched: Version 2.7.3 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/gf-entries-in-excel/vulnerability/wordpress-gravityexport-lite-for-gravity-forms-plugin-2-7-2-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/gf-entries-in-excel/vulnerability/wordpress-gravityexport-lite-for-gravity-forms-plugin-2-7-2-broken-access-control-vulnerability?_s_id=cve)