Gravity Forms CVE-2026-84434: Check Hidden Upload Fields

CVE-2026-84434 lets anyone upload files to a WordPress site through Gravity Forms, without logging in, if a public form has a File Upload field set to Hidden. It affects every version up to and including 3.1.0.4 and is rated CVSS 9.8.^[1] The fix is Gravity Forms 3.1.1, released on September 3.^[2][3]

If your forms auto-update, you’re probably fine. The risk sits with sites that pin plugin versions or renew licences late. Exploit code with a mass-scan mode is already public, so check today.^[5]

TL;DR: What to do right now

1. Check the Gravity Forms version on every site. 3.1.0.4 and lower is vulnerable.^[1]
2. Update to 3.1.1 or later. The current release is 3.1.2.^[3]
3. Can’t update today? Find File Upload fields set to Hidden and delete them, or take those forms offline.
4. Look for executable files in wp-content/uploads/gravity_forms.
5. On Nginx or IIS, block PHP in the uploads folder. Gravity Forms’ own protection is an .htaccess file those servers ignore.^[4]

What CVE-2026-84434 does

Gravity Forms checks the extension of every uploaded file. The advisory says that check was skipped in one case:

hidden file upload fields bypass extension validation

GitHub Advisory Database ^[1]

The rejected file’s upload state was then passed on to be saved anyway.^[1] So an attacker could send a PHP file where the form expected a PDF or an image. The field doesn’t need to be visible on the page. It only needs to exist on a form the attacker can submit.

Why the server matters

Uploading a PHP file is only half the attack. It also has to run. Gravity Forms stores uploads under wp-content/uploads/gravity_forms/ in folders with random names, and it writes an .htaccess file there that stops PHP from running on most servers.^[4] Its documentation warns that this may not protect Nginx, IIS or unusual setups.^[4] The public exploit’s own notes say code execution depends on server configuration.^[5]

So an Apache site with the default .htaccess in place is less exposed. An Nginx site with no rule for that folder is the worst case. Neither is a reason to skip the update.

The timeline

As with most commercial plugins, the changelog didn’t name the flaw.^[3] If you skipped 3.1.1 because it looked like a routine release, this is the one to go back for.

Is CVE-2026-84434 being exploited?

Sources disagree. Patchstack’s database labels it as known to be exploited.^[2] Other trackers still list it as not in CISA’s Known Exploited Vulnerabilities catalog, with a low predicted exploitation score.^[6] We couldn’t confirm a CISA listing ourselves.

What isn’t in doubt is that a public proof-of-concept tool exists. It fingerprints the Gravity Forms version, crawls for forms with hidden upload inputs, and can scan many sites at once.^[5] That lowers the bar for opportunistic attacks, so we’d treat it as exploited.

How to check your sites

1. Check the version

Run this from the site root. The plugin’s folder, and so its WP-CLI slug, is gravityforms.

wp plugin get gravityforms --field=version
# vulnerable: 3.1.0.4 and lower
wp plugin update gravityforms

Gravity Forms is a commercial plugin, so updates come through your licence rather than WordPress.org. If a licence has lapsed, check how that site will get 3.1.1. The Plugins screen in wp-admin shows the same version number.

2. Find hidden File Upload fields

Each field in Gravity Forms has a type and a visibility property, and File Upload fields have the type fileupload.^[7] Save this as gf-hidden-uploads.php and run wp eval-file gf-hidden-uploads.php. It lists every hidden File Upload field in your active forms.

<?php
// Hidden File Upload fields in active forms.
foreach ( GFAPI::get_forms() as $form ) {
  foreach ( $form['fields'] as $field ) {
    if ( 'fileupload' === $field->type
      && 'hidden' === $field->visibility ) {
      printf( "Form %d (%s): field %d %s\n",
        $form['id'], $form['title'],
        $field->id, $field->label );
    }
  }
}

No output means none of your active forms matched. If you do get a hit and can’t update yet, delete that field or unpublish the form until you can.

3. Look for code in the upload folders

Legitimate form uploads are documents and images. A script file in these folders is a red flag.

find wp-content/uploads/gravity_forms -type f \
  \( -iname '*.php*' -o -iname '*.phtml' \
  -o -iname '*.phar' \)
ls -la wp-content/uploads/gravity_forms/.htaccess

The second command confirms the protective .htaccess file is still there. If it’s missing on an Apache site, that’s worth investigating on its own.

4. Block PHP in uploads on Nginx

Nginx ignores .htaccess, so add a rule to the server block. This one covers all of wp-content/uploads, which should never run code anyway. Test with nginx -t before reloading.

location ~* ^/wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
}

5. Agencies: check the whole fleet

Put your WP-CLI aliases (one per line, like @client1) in sites.txt. Sites without Gravity Forms print an error you can ignore.

while read -r site; do
  echo "== $site"
  wp "$site" plugin get gravityforms \
    --field=version < /dev/null
done < sites.txt

Look hardest at sites with expired licences or pinned plugin versions. They’re the likeliest to still be on 3.1.0.x.

If you find something

Take a backup for evidence first. Then remove the files, check for administrators nobody created with wp user list --role=administrator, rotate passwords and keys, and review what else changed on the server around the same time. If a file ran, assume the whole site is compromised.

Forms are an entry point, not just a spam target

Last week’s Visual Composer CVE-2026-12227 write-up showed how a file someone uploads through a form can turn a file-inclusion bug into code execution.^[8] This one skips the middle step: the form itself accepts the file. Our guide to stopping contact form spam covers the everyday side of the same problem, which is strangers submitting whatever they like to your forms.

Zero Spam doesn’t patch Gravity Forms, and it doesn’t scan uploads for malware. What it does is check form submissions, comments and registrations against known bad actors, through the free WordPress plugin or the API. That’s a useful extra filter in front of any form, not a substitute for the update. If it fits, start on the free Explorer plan; code ZEROSPAM20 takes 20% off a paid license.^[9]

FAQ

About Ben Marshall

Full-stack Developer & Engineering Manager

Ben Marshall is a full-stack developer and engineering manager who loves building solid software and helping teams do their best work. He’s equal parts builder and coach—focused on practical architecture, clean implementation, and making collaboration easier (and faster) for everyone.

• WordPress.org