Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms

On August 9th, 2026, Wordfence Argus, created by the Wordfence Threat Intelligence team, discovered an Arbitrary File Upload vulnerability in Gravity Forms, a WordPress plugin estimated to have more than one million active installations. This high-severity vulnerability makes it possible for...

CVE-2026-19513

The Gravity Forms WordPress plugin (all versions ≤ 3.0.2 ) contains an unauthenticated arbitrary file upload vulnerability in the GFAsyncUpload::upload() function. The root cause is insufficient validation of multi-file upload chunk state, where public form state URL hashes can be reused as chunk...

CVE-2026-19513 Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the GFAsyncUpload::upload function, where public form state URL hashes can be reused as chunk...

WordPress Gravity Forms plugin <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion vulnerability

Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion vulnerability discovered by WordFence in WordPress Plugin Gravity Forms versions = 3.0.2...