A critical vulnerability in Gravity Forms, a form-building plugin installed on more than 1 million WordPress sites, lets an unauthenticated attacker upload a malicious file to your server and potentially run their own code on it.

What happened

Wordfence says the flaw affects Gravity Forms versions up to and including 3.0.2. It only applies to sites with a public form that has a File Upload field with “Multiple Files” turned on. The plugin’s chunked upload system, built for handling large multi-file uploads, mixed up two different kinds of hashes and accepted an attacker-chosen filename before checking it was safe. That let an attacker disguise a working PHP or HTML file as an image or PDF and upload it straight to Gravity Forms’ public temporary upload folder, using whatever filename they wanted.

If your site runs on NGINX, or another web server that doesn’t respect .htaccess rules, a file uploaded this way can execute as code the moment an attacker visits it, handing them a foothold on your server. Sites running Apache with working .htaccess protection are harder to exploit this way, but Wordfence still treats the bug as critical because so many hosts don’t offer that protection by default.

Wordfence found the bug on August 9, 2026, using Wordfence Argus, its in-house AI system for vulnerability research. It reported full details to the Gravity Forms team on August 11. The developer acknowledged the report on August 20 and shipped the fix the same day as Gravity Forms 3.0.3.

What to do

  1. Update Gravity Forms to version 3.0.3 or later from your WordPress dashboard.
  2. Check whether any of your public forms use a File Upload field with “Multiple Files” enabled. Those forms were the exposed ones.
  3. If you’re on Wordfence Premium, Care, or Response, you already had a firewall rule blocking known exploit attempts as of August 13. Free Wordfence users get the same rule automatically 30 days after that.
  4. Ask your host whether your server respects .htaccess file restrictions. If it doesn’t, treat this update as urgent rather than routine.

End of article