Broken Access Control in GravityExport Lite for Gravity Forms
CVE-2026-94120

7.5HIGH

Key Information:

Vendor

WordPress
Status
Gravityexport Lite For Gravity Forms
Vendor
CVE Published:
30 September 2026

What is CVE-2026-94120?

A security flaw exists in GravityExport Lite for Gravity Forms that allows unauthorized users to bypass access controls, potentially leading to sensitive data exposure. This vulnerability affects versions 2.7.2 and earlier, enabling attackers to exploit the system without proper authentication. It is critical for users to review their installations and apply necessary updates to safeguard their applications from unauthorized access.

Affected Version(s)

GravityExport Lite for Gravity Forms <= 2.7.2

References

https://patchstack.com/database/wordpress/plugin/gf-entri...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ashish Agarwal (@Donrulezz) | Patchstack Bug Bounty Program
.