CVE-2026-84434 — Gravity Forms ≤ 3.1.0.4 Unauthenticated Arbitrary File Upload
September 25, 2026 · 456 views
Unauthenticated arbitrary file upload in **Gravity Forms** (≤ 3.1.0.4) abusing a hidden **File Upload** field (`upload_file`).
Description
Overview
CVE-2026-84434 is a critical unauthenticated arbitrary file upload in Gravity Forms (≤ 3.1.0.4). A hidden or improperly protected File Upload field (upload_file) allows remote attackers to upload malicious files without logging in.
Impact
Unrestricted upload commonly leads to webshell deployment and full server compromise under the web server user.
Remediation
Upgrade Gravity Forms immediately. Audit uploaded media and form entries for unexpected binaries.
Legal and ethical use
Use bundled tools only on WordPress sites you own or have written authorization to test. Unauthorized scanning or exploitation is illegal in most jurisdictions.
References
- Look up the CVE ID on NVD and the CVE Program for official records.
- Apply vendor/plugin updates from the official repository or vendor advisory before relying on any PoC.
Related PoCs
Same platform, vendor, or tags — explore more write-ups on Pocbit.
- WordPressCVE-2026-18143critical
CVE-2026-18143 — Addify Request a Quote for WooCommerce Unauthenticated File Upload
Unauthenticated arbitrary file upload (CWE-434, CVSS 9.8 Critical) in Request a Quote for WooCommerce ≤ 2.9.2 via public AJAX afrfq_submit_quote_via_popup — unsafe move_uploaded_file() with attacker-controlled .php names into web-accessible RFQ temp storage. Requires popup quote rule on the storefront.
- WordPressCVE-2026-82901critical
CVE-2026-82901 — Ultra Addons for Contact Form 7 Unauthenticated File Upload
Unauthenticated arbitrary file upload (CWE-434, CVSS 3.1 9.8 Critical) in Ultra Addons for Contact Form 7 (Themefic) ≤ 3.5.50 via uacf7_wpcf7_mail_components in the PDF Generator addon — signature field copies files to wp-content/uploads/uacf7-uploads/ with weak validation. Requires PDF Generator enabled on a form with uacf7_signature. Fixed in 3.5.51+.
- WordPressCVE-2026-19660critical
CVE-2026-19660 — Divi Membership (DiviEngine) ≤2.3.0 paypal_param Authentication Bypass
DiviEngine Divi Membership ≤2.3.0: process_paypal_callback on init trusts base64 paypal_param GET without PayPal/IPN validation → wp_set_current_user + wp_set_auth_cookie as arbitrary user ID (incl. admin). PayPal gateway class loads even when disabled. CVSS 9.8 Critical (CWE-287). Python PoC: check/exploit, cookie export, mass scan.
- WordPressCVE-2026-87902critical
CVE-2026-87902 — WordPress Core get_page_template() Unauthenticated LFI → RCE (PEAR chain)
WordPress core 4.7.0–7.1.1: pagename from POST used in get_page_template() without validate_file(); page-templates/ traversal + PEAR gadget → RCE. GHSA-7hp8-65ch-5whp, CVSS 4.0 9.8, CWE-22. Fixed 7.1.2+ (backports 6.8.10, 7.0.6). Python mass scanner: --check, --rce, --shell. Upstream: MRdark-ops/CVE-2026-87902 (HackfutSecRoot).