---
title: "WordPress Gravity Forms Vulnerability (CVE-2026-84434): Check Your Site"
slug: "wordpress-gravity-forms-vulnerability-cve-2026-84434"
published: "2026-09-19"
updated: "2026-09-23"
categories:
  - "Payload"
tags:
  - "gravity forms vulnerability"
  - "cve-2026-84434"
  - "wordpress security"
  - "hidden file upload"
  - "payload cms security"
  - "wordpress plugin vulnerabilities"
audience-level: "intermediate"
llm-purpose: "Critical CVE-2026-84434 in WordPress Gravity Forms allows unauthenticated file uploads. Check version 3.1.1+, hidden upload fields, and how to reduce…"
---

**Summary Triples**
- (WordPress Gravity Forms Vulnerability (CVE-2026-84434): Check Your Site, expresses-intent, reference)
- (WordPress Gravity Forms Vulnerability (CVE-2026-84434): Check Your Site, covers-topic, gravity forms vulnerability)
- (WordPress Gravity Forms Vulnerability (CVE-2026-84434): Check Your Site, provides-guidance-for, Critical CVE-2026-84434 in WordPress Gravity Forms allows unauthenticated file uploads. Check version 3.1.1+, hidden upload fields, and how to reduce…)

### {GOAL}
Critical CVE-2026-84434 in WordPress Gravity Forms allows unauthenticated file uploads. Check version 3.1.1+, hidden upload fields, and how to reduce…

### {PREREQS}
- Familiarity with the concepts discussed in this article.

### {STEPS}
1. Follow the detailed walkthrough in the article content below.

<!-- llm:goal="Critical CVE-2026-84434 in WordPress Gravity Forms allows unauthenticated file uploads. Check version 3.1.1+, hidden upload fields, and how to reduce…" -->

# WordPress Gravity Forms Vulnerability (CVE-2026-84434): Check Your Site
> Critical CVE-2026-84434 in WordPress Gravity Forms allows unauthenticated file uploads. Check version 3.1.1+, hidden upload fields, and how to reduce…
Matija Žiberna · 2026-09-19

**Your company's WordPress website could be exposed. Check this plugin today.**

A critical vulnerability has been disclosed in Gravity Forms, a widely used WordPress form plugin.

CVE-2026-84434 carries a severity score of **9.8 out of 10**.

The vulnerability could allow attackers to upload potentially executable files without logging in, potentially leading to remote code execution.

Not every Gravity Forms installation is exploitable. The attack requires a publicly accessible form containing a File Upload field with its visibility set to Hidden.

## If your company runs its website on WordPress, here's what to do today:

1. Ask whoever manages your website whether Gravity Forms is installed.
2. If it is, check that you're running version 3.1.1 or newer. Version 3.1.2 is also available.
3. Ask them to review your forms for hidden file upload fields and investigate suspicious uploads if your site was exposed.
4. Make sure your contact forms, lead generation forms, and integrations still work after updating.

The security fix was released on September 3. The vulnerability was publicly disclosed on September 18.

For more than two weeks, the fix was available, but the release notes described it only as "security enhancements."

## Why dependency control matters

Every third-party plugin introduces another dependency that needs to be monitored, updated, and tested. But third-party extensions are not the only exposure point—as demonstrated by the recent [critical WordPress Core template vulnerability (CVE-2026-87902)](/blog/wordpress-core-vulnerability-cve-2026-87902), the underlying platform itself requires rapid operational response.

This is one of the primary reasons I build client websites with [Payload CMS](https://payloadcms.com/). We can implement form handling, uploads, and integrations directly in the application layer rather than relying on an ever-growing collection of third-party plugins.

If you are currently evaluating your CMS architecture or moving away from legacy WordPress maintenance overhead, see my [Complete 2026 WordPress to Payload Migration Guide](/blog/wordpress-to-payload-migration-guide) for how to migrate data safely. For technical teams planning production infrastructure, [Payload CMS in Production: Honest Answers](/blog/payload-cms-in-production-honest-answers) and the [Self-Hosted Next.js 16 + Payload Deployment Guide](/blog/deploy-payload-cms-nextjs-16-self-hosted) explore how direct code ownership gives you full control over your security surface.

It doesn't eliminate security risks. But it gives us greater control over our dependencies and how we maintain them.

Source: [Wordfence vulnerability report](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/gravityforms/gravity-forms-3104-unauthenticated-arbitrary-file-upload-via-hidden-file-upload-field)