CVE-2026-19513

Gravity Forms for WordPress, in all versions up to and including 3.0.2, is vulnerable to unauthenticated arbitrary file upload because the GFAsyncUpload::upload() function insufficiently validates multi-file upload chunk state, allowing public form state URL hashes to be reused as chunk continuation hashes and attacker-controlled temporary filenames to be accepted before sanitization. An attacker can target any publicly reachable form containing a File Upload field with the Multiple Files option enabled and plant a PNG/PDF polyglot under an attacker-chosen .php or .html filename in the plugin's temporary upload directory. On NGINX or other web servers that do not honor the .htaccess file the plugin installs in that directory, the uploaded .php file can execute, yielding remote code execution on the WordPress host; on Apache-style servers where PHP execution is blocked, uploaded HTML can instead produce stored same-origin cross-site scripting if a victim visits the generated file URL. Any WordPress site running Gravity Forms 3.0.2 or earlier with such a form is affected, with the RCE scenario limited to non-.htaccess-respecting servers. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.5% probability of exploitation within 30 days and the issue is not in CISA's KEV catalog.

What to do: Update Gravity Forms to a patched release newer than 3.0.2 as soon as it is available. As interim mitigation, deny PHP execution in the Gravity Forms uploads directory at the web-server level (e.g., an NGINX location block), disable the Multiple Files option on public forms, and audit the Gravity Forms temporary upload directory for unexpected .php or .html files. Note that Apache sites are protected from RCE by the bundled .htaccess but remain exposed to stored XSS via uploaded HTML, so do not treat .htaccess as a complete fix.