Improper File Upload Vulnerability in Gravity Forms Plugin by Rocketgenius
CVE-2026-119529
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 November 2026
Badges
What is CVE-2026-119529?
The Gravity Forms plugin for WordPress, prior to version 3.2.2, contains a vulnerability that fails to properly restrict the file types that can be uploaded by unauthenticated users through its chunked file upload feature. This oversight exposes the server to risks, as unauthorized individuals could exploit this weakness to read sensitive server environment variables and access files within the web root. Specifically, this issue arises on servers configured to parse Server-Side Include (SSI) documents, such as those using Apache with SSI enabled, potentially leading to unauthorized disclosure of server information.
Affected Version(s)
Gravity Forms 0 < 3.2.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.