CVE-2026-84434: 
WordPress vulnerability analysis and mitigation

CVE-2026-84434 is a critical arbitrary file upload vulnerability in the Gravity Forms plugin for WordPress, affecting all versions up to and including 3.1.0.4. The flaw exists in the upload_file function and enables unauthenticated remote attackers to upload executable files, potentially leading to remote code execution (RCE). It was published on September 19, 2026, and assigned a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and stems from a mismatch between the field validation pipeline and the file persistence pipeline in Gravity Forms. When a File Upload field has its Visibility set to 'Hidden', the extension validation step is bypassed; a rejected file's intact upload state is subsequently passed to upload_file() without re-validation, allowing executable files to be persisted on the server. Exploitation requires only that the targeted WordPress site hosts a publicly accessible form containing a hidden File Upload field — no authentication is needed (GitHub Advisory, Wordfence).

Successful exploitation allows an unauthenticated attacker to upload and potentially execute arbitrary files (e.g., PHP web shells) on the WordPress server, resulting in full remote code execution. This carries high confidentiality, integrity, and availability impact — an attacker could exfiltrate sensitive data, modify site content, install backdoors, or pivot to other systems on the same network. The scope of impact is limited to the affected component but can escalate to full server compromise depending on the hosting environment (GitHub Advisory, Wordfence).

As of the disclosure date (September 19, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is reported as 0.0, indicating low current exploitation probability, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at this time. However, the low attack complexity, lack of authentication requirement, and high CVSS score make this a high-priority target if exploitation details become public.

1. Reconnaissance: Identify WordPress sites running Gravity Forms ≤ 3.1.0.4 using tools like WPScan, Shodan, or by inspecting page source for Gravity Forms indicators (e.g., gform_wrapper CSS classes or gravityforms script handles).
2. Identify target form: Browse publicly accessible forms on the target site and identify any form that contains a File Upload field configured with Visibility set to 'Hidden'. This may require inspecting the rendered HTML or form source for hidden file input elements.
3. Craft malicious upload request: Prepare an executable file (e.g., a PHP web shell such as shell.php) and craft an HTTP POST request to the form's submission endpoint, targeting the hidden file upload field parameter.
4. Bypass validation: Submit the crafted request. Because the hidden field bypasses extension validation, the file's upload state passes intact to upload_file() without re-validation, allowing the executable file to be persisted in the server's upload directory.
5. Locate uploaded file: Determine the upload path (typically within wp-content/uploads/gravity_forms/) by analyzing server responses or using directory enumeration.
6. Execute payload: Access the uploaded web shell via its URL to achieve remote code execution on the server (GitHub Advisory, Wordfence).

• Network: Unexpected HTTP POST requests to WordPress form submission endpoints containing file upload parameters with executable file extensions (e.g., .php, .phtml, .php5); outbound connections from the web server to unknown external IPs following form submissions.
• File System: Presence of PHP files or other executable scripts in wp-content/uploads/gravity_forms/ or subdirectories; newly created files with web shell signatures (e.g., eval(, base64_decode(, system(, passthru().
• Logs: Web server access logs showing POST requests to Gravity Forms endpoints followed by GET requests to files in the uploads directory; error logs referencing unexpected file types in the Gravity Forms upload handler.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as bash, curl, wget, or python with suspicious arguments.

Update the Gravity Forms plugin to a version newer than 3.1.0.4, which contains the fix for this vulnerability (Gravity Forms Changelog). As an interim workaround, administrators should audit all WordPress forms and either remove or reconfigure File Upload fields that have their Visibility set to 'Hidden', or restrict form access to authenticated users only. Additionally, consider implementing server-side controls to block execution of uploaded files in the wp-content/uploads/ directory (e.g., via .htaccess rules or web server configuration) (Wordfence).