Critical File Upload Vulnerability in Gravity Forms Exposes WordPress Sites to RCE
Wordfence has discovered a critical unauthenticated arbitrary file upload vulnerability in the popular Gravity Forms WordPress plugin, potentially allowing remote code execution.
Wordfence researchers have identified a critical security flaw in Gravity Forms, a widely-used WordPress plugin with over one million active installations. The vulnerability, tracked as CVE-2026-19513, allows unauthenticated attackers to upload files with arbitrary extensions to a public temporary directory on the server. This capability can be leveraged to achieve remote code execution (RCE), posing a significant threat to WordPress websites.
The vulnerability stems from insufficient validation of multi-file upload chunk states within the plugin's GFAsyncUpload::upload() function. Specifically, the plugin incorrectly reuses public form state URL hashes as chunk continuation hashes. This cryptographic domain confusion allows an attacker to craft a specific URL whose hash matches a legitimate chunk continuation hash, bypassing security checks. The issue is compounded by the fact that the plugin assigns the attacker-controlled temporary filename before sanitization, enabling the upload of malicious files.
While the plugin's temporary upload directory typically prevents direct execution of PHP files due to an included .htaccess file, the vulnerability can still lead to stored cross-site scripting (XSS) if an attacker uploads malicious HTML files and a victim visits the generated URL. However, on web servers like NGINX that do not respect .htaccess files, the upload of a valid PNG/PDF polyglot disguised as a PHP file could directly lead to remote code execution.
Wordfence disclosed the vulnerability to the Gravity Forms team on August 11, 2026, through their Vulnerability Management Portal. The developers promptly acknowledged the report on August 20, 2026, and released version 3.0.3 of Gravity Forms to address the issue on the same day. Wordfence commended the Gravity Forms team for their swift response and remediation efforts.
Wordfence Premium, Care, and Response customers received a protective firewall rule on August 13, 2026. Free users will receive the same protection on September 12, 2026. The company strongly advises all users to update their Gravity Forms installations to version 3.0.3 or a later version as soon as possible to mitigate the risk of exploitation.
The vulnerability has a CVSS rating of 8.1, classifying it as High severity. The affected versions of Gravity Forms are 3.0.2 and earlier. The discovery was made using Wordfence Argus, an AI-powered tool developed by Wordfence for aggressive vulnerability hunting in WordPress plugins and themes.
This incident highlights the ongoing risks associated with complex plugins that handle file uploads. Developers must implement robust validation and sanitization for all user-supplied data, especially when dealing with file uploads, to prevent attackers from exploiting such weaknesses for code execution or other malicious purposes.