VulnSocial

CVE-2026-84434Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 12 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 3 signals
  • Patch or workaround mentioned in 5 signals
  • Technical details provided in 11 signals
  • Disclosure: 5 classified signals
  • Peaked 4d ago at 4 mentions (2026-09-19); latest day: 1
  • 12 total mentions across 5 days

Deep dive

Activity timeline12 mentions / 5d
01234Mentions · 2026-09-19: 4Mentions · 2026-09-21: 3Mentions · 2026-09-22: 3Mentions · 2026-09-24: 1Mentions · 2026-10-12: 1PoC Mentioned / Linked · 2026-09-19: 1PoC Mentioned / Linked · 2026-09-21: 1PoC Mentioned / Linked · 2026-09-22: 1Exploit Tool / Code · 2026-09-21: 1Patch / Workaround · 2026-09-19: 2Patch / Workaround · 2026-09-22: 2Patch / Workaround · 2026-09-24: 1Technical Details · 2026-09-19: 3Technical Details · 2026-09-21: 3Technical Details · 2026-09-22: 3Technical Details · 2026-09-24: 1Technical Details · 2026-10-12: 109-1909-2109-2209-2410-12
Signal classification3 categories
Disclosure
541.7%
Patch
433.3%
PoC
325.0%
Referenced assets12 URLs
By indicator
Classification over time
DateTotalLabels
2026-09-194
Disclosure1Patch2PoC1
2026-09-213
Disclosure2PoC1
2026-09-223
Disclosure1Patch1PoC1
2026-09-241
Patch1
2026-10-121
Disclosure1
Full discourse12 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-84434 - critical 🚨 WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload > Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticate... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-84434 @pdnuclei #N...

    Post summary

    The tweet discloses CVE-2026-84434, a critical unauthenticated arbitrary file upload flaw affecting Gravity Forms WordPress plugin versions ≤3.1.0.4, and references a Project Discovery library entry for detection.

    00061454
    1.4K followersView on X
  • Ryx@PadhiyarRushi
    Patch

    A hidden field can become the security boundary that isn't actually a boundary. CVE-2026-84434 | CVSS 9.8 Gravity Forms ≤3.1.0.4 has an arbitrary file upload flaw caused by a mismatch between: validation → persistence A Hidden File Upload field can bypass extension validation, while the later upload path persists the file without re-validating it. If the form is publicly accessible, exploitation does not require authentication. Patch: 3.1.1 https://www.wordfence.com/threat-intel/vulnerabilities/gravityforms/gravity-forms-3104-unauthenticated-arbitrary-file-upload-via-hidden-file-upload-field #Cybersecurity #Infosec #WordPress #AppSec #RCE #BugBounty

    Post summary

    The tweet describes CVE-2026-84434, an unauthenticated arbitrary file upload vulnerability in Gravity Forms versions ≤3.1.0.4, and indicates that version 3.1.1 patches the flaw.

    00051448
    954 followersView on X
  • mürrez@murrezsec
    PoC

    Just released the PoC for CVE-2026-84434! 🚨 🛡️ Details & PoC: https://github.com/murrez/CVE-2026-84434 #CyberSecurity #Infosec #PoC #Vulnerability #Exploit

    Post summary

    The tweet announces and shares a proof of concept for CVE-2026-84434 via a GitHub repository, with no additional details on exploitation, patches, or technical vulnerability specifics.

    01041174
    636 followersView on X
  • Varun Dubey@vapvarun
    Disclosure

    Patching a file-upload flaw does not remove what was already uploaded. Bricksforge CVE-2026-85097 and Gravity Forms CVE-2026-84434: version check, PHP in uploads, access logs (403 = blocked, 200 = it ran), cleanup order. https://tweakswp.com/plugin-file-upload-flaw-check-and-clean/ #WordPress #infosec

    Post summary

    The post names two CVEs and gives brief technical context about file uploads, PHP execution, and log status codes. It does not provide a PoC, report active exploitation, or identify a specific remediation.

    0003061
    3.1K followersView on X
  • dbugs@ptdbugs
    PoC

    A PoC/exploit has been discovered for vulnerability CVE-2026-84434 PT ID: PT-2026-95738 Vendor: WordPress/Gravity Forms Product: Gravity Forms Description: The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition. References: • https://dbu.gs/vulnerability/PT-2026-95738 • https://github.com/murrez/cve-2026-84434

    Post summary

    The text announces the discovery of a PoC/exploit for CVE-2026-84434, an unauthenticated arbitrary file upload vulnerability in Gravity Forms <= 3.1.0.4, providing detailed technical root cause analysis and a link to a public GitHub repository hosting the PoC code.

    01020427
    3.7K followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-84434 Gravity Forms WordPress plugin, arbitrary file upload to RCE, CVSS 9.8, no patch yet. Unauthenticated attackers can run code. Update immediately or disable. https://www.valtersit.com/cve/CVE-2026-84434 #CVE #infosec #WordPress #GravityForms #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet discloses CVE-2026-84434, a Gravity Forms WordPress plugin vulnerability (arbitrary file upload to RCE, CVSS 9.8), and though no patch exists, it explicitly advises updating immediately or disabling the plugin as mitigation.

    0001048
    1.1K followersView on X
  • WordPressは静的サイトに置き換えよう！@tyamadadd
    PoC

    WordPressの問い合わせフォームプラグイン「Gravity Forms」の脆弱性が、9月19日にGitHub Advisory Databaseへ登録されました。CVE-2026-84434、CVSSは9.8です。ログインしていない第三者が任意のファイルを置ける状態で、GitHubでは実証コードも公開されています。 ■ 成立する条件 ・公開しているフォームに「ファイルアップロード」の項目がある ・その項目の表示設定を「非表示（Hidden）」にしている 画面に出ていなくても処理の受け口は開いています。入力の検証と保存の流れが食い違い、拒否されたはずのファイルが確かめ直されないまま保存されます。 ■ 対象のバージョンと修正版 ・対象：3.1.0.4以下 ・修正：3.1.1以降 Gravity Formsは有料のプラグインで、WordPress公式のディレクトリにはありません。バージョンの確認と更新は管理画面から行います。 ■ 確認すること フォームに「非表示にしたファイルアップロードの項目」が残っていないかを見てください。バージョンが3.1.0.4以下なら更新します。更新しても、すでに置かれたファイルは消えません。保存先に見覚えのないファイルが増えていないかも、あわせて確認してください。

    Post summary

    The post announces a high-severity Gravity Forms vulnerability, explicitly notes that public proof-of-concept code exists, and also provides fixed-version and remediation guidance. The PoC availability is a central takeaway, though patch information is also prominent.

    10000118
    11 followersView on X
  • ADK Cyber@ADKCyber
    Patch

    Gravity Forms WordPress plugin (≤3.1.0.4) has a CVSS 9.8 arbitrary file upload flaw. Update immediately if in use: https://nvd.nist.gov/vuln/detail/CVE-2026-84434 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/XMh0EM0Hqs

    Post summary

    The tweet discloses CVE-2026-84434 as a CVSS 9.8 arbitrary file upload vulnerability in Gravity Forms WordPress plugin (≤3.1.0.4) and urges immediate updating, but contains no PoC, named exploit, or evidence of active exploitation.

    1000040
    97 followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen Kritische WordPress-Lücken in Gravity Forms und Forminator: Zwei CVEs ohne Anmeldung ausnutzbar #cve202684434 #cve202692229 #forminator #gravityforms #rocketgenius #wordpress #wpmudev https://cybersecurity-news.de/wordpress-schwachstellen-gravity-forms-forminator-cve-2026-84434-cve-2026-92229

    Post summary

    The tweet announces critical WordPress vulnerabilities in Gravity Forms and Forminator, including two CVEs exploitable without authentication, and links to a news article. It does not provide a PoC, named exploit tool, patch, or active exploitation report.

    0000035
    13 followersView on X
  • LoreleiWeb@LoreleiWeb
    Disclosure

    🆕👉 Gravity Forms https://wpdeeply.com/gravity-forms-3-1-0-4-unauthenticated-file-upload-cve-2026-84434/ #loreleiweb Gravity Forms 3.1.0.4 and earlier is vulnerable to unauthenticated arbitrary file upload when a publicly accessible form contains a File Upload field whose visibility is set to Hidden. The issue is tracked as CVE-2026-844… https://t.co/PVt0ZykqFh

    Post summary

    Gravity Forms 3.1.0.4 and earlier are affected by an unauthenticated arbitrary file upload vulnerability (CVE-2026-84434) when a file upload field is hidden on a public form. The tweet discloses the issue without mentioning exploits, PoCs, patches, or active exploitation.

    00000179
    85.8K followersView on X
  • Severity Daily@severitydaily
    Patch

    Gravity Forms’ 9.8 file upload cites a last-vulnerable version the vendor’s changelog has never listed. The likely fix shipped as “Added security enhancements.” No exploitation reported. https://severitydaily.com/gravity-forms-cve-2026-84434-3-1-0-4-not-in-changelog/

    Post summary

    The post discusses a Gravity Forms vulnerability while noting the likely fix shipped as 'Added security enhancements' and explicitly says no exploitation has been reported. The strongest actionable indicator is the mention of a likely vendor fix.

    0000033
    24 followersView on X
  • ThreatAft@ThreatAft
    Disclosure

    🚨 GRAVITY FORMS CVE-2026-84434 — CVSS 9.8 Unauthenticated arbitrary file upload. Hidden File Upload field bypasses validation. Webshell → RCE. → https://threataft.com/articles/gravity-forms-cve-2026-84434-unauthenticated-file-upload-rce #GravityForms #WordPress #CVE #RCE #PatchNow #CyberSecurity #ThreatIntel

    Post summary

    The tweet announces a critical vulnerability in Gravity Forms (CVE-2026-84434) with a CVSS score of 9.8, describing an unauthenticated arbitrary file upload that can lead to remote code execution. No specific patch, exploit, or active exploitation is mentioned.

    0000057
    44 followersView on X

Explore more

Back to dashboard