CVE-2026-19513Disclosure

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This makes it possible for unauthenticated attackers, when a public form contains a File Upload field with Multiple Files enabled, to upload a valid PNG/PDF polyglot to an attacker-selected public `.php` or `.html` filename in the Gravity Forms temporary upload directory. This can lead to remote code execution on WordPress systems that use NGINX or other non `.htaccess` respecting web servers. NOTE: During installation and activation, the Gravity Forms plugin places a `.htaccess` file in this directory, which prevents this vulnerability from being exploited despite the PHP file being written to the temporary upload directory. In these cases where PHP execution is blocked, attacker-written HTML can result in stored same-origin cross-site scripting if a victim visits the generated file URL.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
5 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 4 signals
Technical details provided in 5 signals
Disclosure: 3 classified signals
Peaked 4d ago at 1 mentions (2026-09-01); latest day: 1
5 total mentions across 5 days

Deep dive

Activity timeline5 mentions / 5d

Signal classification2 categories

Disclosure

360.0%

Patch

240.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-01	1	Disclosure1
2026-09-02	1	Disclosure1
2026-09-03	1	Disclosure1
2026-09-09	1	Patch1
2026-09-21	1	Patch1

Full discourse5 posts

Rıdvan Yağlı@ridvanyagli45d
Disclosure
🔴 Gravity Forms adlı WordPress eklentisinde Kritik Açık! - CVE-2026-19513 WordPress'in popüler Gravity Forms eklentisinde kimlik doğrulaması gerektirmeyen Arbitrary File Upload açığı tespit edildi. 3.0.2 ve önceki sürümler etkileniyor. Uygun sunucu yapılandırmalarında açık, uzaktan kod çalıştırmaya (RCE) kadar ilerleyebiliyor. 🔒 3.0.3 veya üzeri sürüme güncellenmesi gerekiyor. Detaylar: https://www.wordfence.com/blog/2026/09/wordfence-argus-finds-unauthenticated-arbitrary-file-upload-vulnerability-in-gravity-forms/
Post summary
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-19513) exists in Gravity Forms 3.0.2 and earlier, potentially allowing remote code execution; users should upgrade to version 3.0.3 or newer.
00033558
2.4K followersView on X
LoreleiWeb@LoreleiWeb45d
Disclosure
🆕👉 Gravity Forms https://wpdeeply.com/gravity-forms-3-0-2-unauthenticated-arbitrary-file-upload/ #loreleiweb CVE-2026-19513 is a newly disclosed Gravity Forms vulnerability affecting versions up to and including 3.0.2. Wordfence published the record on September 1, 2026 and reports that the issue can be reached without authenti… https://t.co/BD1p90wYHN
Post summary
The tweet announces the discovery of CVE‑2026‑19513, an unauthenticated arbitrary file upload flaw in Gravity Forms up to 3.0.2, without providing PoC, exploit code, or patch information.
00010263
85.9K followersView on X
DFIR Radar@DFIR_Radar46d
Disclosure
CVE-2026-19513 (CVSS 8.1): Unauthenticated arbitrary file upload in Gravity Forms affects 1M+ WordPress installs, enabling remote code execution on NGINX-backed sites. Key details: - CVE-2026-19513, CVSS 8.1 High. Gravity Forms versions up to and including 3.0.2 allow unauthenticated attackers to write a PNG/PHP polyglot to the plugin's public temp upload directory with an attacker-chosen .php extension. The root cause is a cryptographic domain-confusion flaw: wp_hash() was reused without context separation for both public form state and chunk-continuation auth, letting attackers reuse a legitimate URL hash to authenticate a malicious upload continuation request. - Exploitation requires a public form with a multi-file upload field enabled. PNG and PDF are permitted by default, so no admin allowlist change is needed. The attacker supplies a benign carrier filename (safe.png) while forcing the sanitized temp destination to end in .php, then triggers a final-chunk rename that strips the .part suffix and leaves an executable file on disk. - Impact is server-dependent. Apache installs are partially mitigated by a .htaccess the plugin writes to the upload directory, blocking PHP execution. NGINX ignores .htaccess, making RCE directly reachable. Even on protected Apache installs, writing a .html file enables stored same-origin XSS. #DFIR_Radar
Post summary
CVE‑2026‑19513 is a high‑CVSS flaw that permits unauthenticated file uploads, enabling RCE on NGINX‑based WordPress sites; the text outlines the root cause, exploitation mechanics, and a mitigation via .htaccess, but no PoC or active attacks are reported.
10000205
1.9K followersView on X
Phil_Taboada@Phil2427544326d
Patch
Si usas Gravity Forms y subes varios archivos, actualiza a 3.0.3. CVE-2026-19513 en ≤3.0.2 puede dejar escribir .php sin login. https://www.wavys-technologies.com/es/blog/gravity-forms-cve-2026-19513
Post summary
The post warns that Gravity Forms ≤3.0.2 is vulnerable to unauthenticated .php file upload (CVE-2026-19513) and urges upgrading to version 3.0.3 to patch the issue.
0000035
3 followersView on X
Phil_Taboada@Phil2427544338d
Patch
Si usas Gravity Forms (3.0.2 o menos) con varios archivos en un formulario público, actualiza a 3.0.3. Sin login podían escribir .php. En NGINX duele más. https://www.wavys-technologies.com/es/blog/gravity-forms-cve-2026-19513
Post summary
Gravity Forms users on versions 3.0.2 or older should upgrade to 3.0.3 to remediate an unauthenticated file upload flaw that allows attackers to write PHP files.
0000045
3 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-19513

Rıdvan Yağlı[verified]@ridvanyagliDisclosure

A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-19513) exists in Gravity Forms 3.0.2 and earlier, potentially allowing remote code execution; users should upgrade to version 3.0.3 or newer.

DFIR Radar[verified]@DFIR_RadarDisclosure

CVE‑2026‑19513 is a high‑CVSS flaw that permits unauthenticated file uploads, enabling RCE on NGINX‑based WordPress sites; the text outlines the root cause, exploitation mechanics, and a mitigation via .htaccess, but no PoC or active attacks are reported.

LoreleiWeb@LoreleiWebDisclosure

The tweet announces the discovery of CVE‑2026‑19513, an unauthenticated arbitrary file upload flaw in Gravity Forms up to 3.0.2, without providing PoC, exploit code, or patch information.

Phil_Taboada@Phil24275443Patch

The post warns that Gravity Forms ≤3.0.2 is vulnerable to unauthenticated .php file upload (CVE-2026-19513) and urges upgrading to version 3.0.3 to patch the issue.

Phil_Taboada@Phil24275443Patch

Gravity Forms users on versions 3.0.2 or older should upgrade to 3.0.3 to remediate an unauthenticated file upload flaw that allows attackers to write PHP files.