Gravity Forms CVE-2026-84434: Update to 3.1.1 or Later for Hidden File Upload Flaw
Gravity Forms users running 3.1.0.4 or earlier should update to 3.1.1 or later for CVE-2026-84434, a critical arbitrary-file-upload vulnerability affecting publicly accessible forms that contain a File Upload field with Visibility set to Hidden. Wordfence, the CVE Numbering Authority for the record, assigns the issue CVSS 9.8 and identifies 3.1.1 as the patched release.
Gravity Forms has since released 3.1.2, dated September 17, 2026. Its official changelog lists security enhancements for both 3.1.1 and 3.1.2. The CVE-to-fix mapping comes from Wordfence; the vendor changelog records the release dates and security-enhancement entries without naming this CVE. Sites updating now should use the latest supported release available to them.
The exposure has a specific configuration requirement. An attacker needs a publicly reachable Gravity Forms form containing a File Upload field whose Visibility is set to Hidden. Administrators should patch the plugin and use that field configuration to prioritize exposure checks.
Affected and fixed versions
| Item | CVE-2026-84434 status |
|---|---|
| Product | Gravity Forms for WordPress |
| Affected versions | Up to and including 3.1.0.4 |
| First patched version reported by Wordfence | 3.1.1 |
| Current vendor changelog release | 3.1.2, September 17, 2026 |
| Required form condition | Publicly accessible form with a File Upload field set to Hidden |
| Authentication | None required when the vulnerable form condition is present |
| CWE | CWE-434, unrestricted upload of a dangerous file type |
| Wordfence CVSS | 9.8 Critical |
Wordfence's CVE record says the flaw sits between the field-validation and file-persistence paths. Hidden File Upload fields can bypass extension validation, while rejected upload state can later reach upload_file() without the expected re-validation. That sequence can allow an unauthenticated attacker to upload a file that the normal validation path should reject.
Executable-file impact depends on the web server and upload execution environment. The CVE description states that uploaded files may be executable, making remote code execution possible where the server will execute the uploaded file. The arbitrary-upload primitive is the core vulnerability; server configuration determines whether an uploaded payload can execute as code.
What administrators should do
Update Gravity Forms first. Wordfence identifies 3.1.1 as the patched version, while Gravity Forms' current changelog lists 3.1.2. An installation still on 3.1.0.4 or earlier is within the affected range.
Then inspect public forms for File Upload fields configured with Visibility: Hidden. That condition is part of the published exploitability description and provides a useful way to prioritize exposure checks across sites with many forms.
After updating, review the WordPress host and upload directories if the site exposed the vulnerable configuration before patching. Useful checks include unexpected executable files, unfamiliar recently created files, anomalous web requests around form submission endpoints, and unexplained WordPress or hosting-account changes. Evidence of compromise warrants incident-response handling in addition to the plugin update.
Patch-version evidence
The public records provide two complementary pieces of evidence. Wordfence explicitly maps CVE-2026-84434 to versions through 3.1.0.4 and reports 3.1.1 as patched. Gravity Forms' own changelog records 3.1.1 on September 3 and 3.1.2 on September 17, with each release listing "security enhancements."
The vendor changelog leaves the CVE identifier unnamed. This article therefore attributes the affected/fixed mapping to the Wordfence CVE record and the release dates to Gravity Forms' official changelog.
The CISA Known Exploited Vulnerabilities catalog reviewed for this article contains no CVE-2026-84434 entry. The available evidence supports critical technical severity and a concrete patch requirement; this article makes no claim of CISA-confirmed exploitation in the wild.
Bottom line
Gravity Forms installations on 3.1.0.4 or earlier have a high-impact patching priority when a public form contains a hidden File Upload field. Upgrade to 3.1.1 or later, preferably the current supported release, and audit exposed forms and upload locations. The configuration prerequisite narrows exposure, while the unauthenticated arbitrary-upload path makes affected public forms consequential enough to address promptly.