CVE-2026-84434 Details.
WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload
Atlas does not check this one. Needs requests that change data.
To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check.
About CVE-2026-84434. What It Means.
Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticated arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields. Unauthenticated attackers can upload any file type including PHP when a form has a File Upload field configured with Hidden visibility. The bypass works because the server-side extension validation is skipped for fields with gfield_visibility_hidden CSS class.
Affected Product. What Is Hit.
- Vendor
- rocketgenius
- Product
- Rocketgenius Gravityforms
References. Where To Read More.
- https://github.com/murrez/CVE-2026-84434
- https://patchstack.com/database/wordpress/plugin/gravityforms/vulnerability/wordpress-gravity-forms-plugin-3-1-0-4-unauthenticated-arbitrary-file-upload-via-hidden-file-upload-field-vulnerability
- https://www.wordfence.com/threat-intel/vulnerabilities/id/787e22a9-329b-4e71-bc2a-4f5524fc9356
- https://docs.gravityforms.com/gravityforms-change-log/
FAQ
Common Questions.
WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload. Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticated arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields. Unauthenticated attackers can upload any file type including PHP when a form has a File Upload field configured with Hidden visibility. The bypass works because the server-side extension validation is skipped for fields with gfield_visibility_hidden CSS class.
No. To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check. The facts about CVE-2026-84434 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-84434 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Rocketgenius Gravityforms to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-84434. Atlas does not run a check for it, so nothing here says whether a particular site is affected.