A single hashing shortcut in Gravity Forms let anyone on the internet write a file with a name of their choosing into a public folder on more than a million WordPress sites. On servers that run PHP out of that folder, that is remote code execution, which means attacker-supplied code running as the website itself.
The flaw is tracked as CVE-2026-19513 and carries a CVSS score of 8.1 out of 10. It affects every version of the plugin up to and including 3.0.2, and Gravity Forms fixed it in version 3.0.3, released on August 20, 2026.
Alex Thomas and Wordfence Argus, the automated research tool built by the Wordfence Threat Intelligence team, found the bug on August 9 and sent full disclosure details to the Gravity Forms developers two days later. The technical breakdown is in the original report.
One hash doing two unrelated jobs
Gravity Forms can accept a large upload in pieces, or chunks. Each follow-up chunk has to prove it belongs to an upload already in progress, and version 3.0.2 did that with a signature produced by WordPress's wp_hash() function.
The trouble is that the plugin called the very same function somewhere else, to fingerprint the public page URL a form sits on, with nothing in either signature marking which of the two jobs it was for. A visitor controls the URL they ask for. So an attacker could request a page whose URL signature also passed as a valid upload-continuation signature. Nothing has to be stolen and nothing has to be forged. A legitimate value, generated for an unrelated purpose, is simply presented in a context it was never meant for.
The filename was trusted before it was cleaned
A second mistake decided how bad that was. The upload handler checked the signature against the raw filename the attacker had supplied, adopted that value as the destination name, and only afterwards ran it through WordPress's filename sanitizer. The upload could therefore present an innocent name such as safe.png, satisfy the plugin's file-type checks, and still land on disk with a .php extension. A PNG and PHP polyglot, a single file valid both as an image and as a script, satisfies both sides of that check at once.
Two things have to line up on the target site, and neither is exotic: a form that is publicly reachable, and a File Upload field with the Multiple Files option switched on. WordPress and Gravity Forms both accept PNG and PDF by default, so no administrator needs to have widened an allowlist for this to work.
Apache shrugs this off, NGINX does not
What happens next depends entirely on the web server. When the plugin is installed it drops an .htaccess file into the temporary upload directory with directives that disable PHP parsing, and on a typical Apache configuration that is enough to stop the attack dead. NGINX does not read .htaccess files at all. On those servers the planted .php file executes, and that is the remote code execution case. Where PHP really is blocked, Wordfence notes an attacker can write a .html file instead and get stored cross-site scripting on the site's own domain.
Update to 3.0.3, then look at your public forms
Version 3.0.3 is the first release carrying the complete fix. Gravity Forms now generates temporary filenames on the server, replaces the ambiguous shared value with a signed token bound to one upload session, and rejects any continuation whose partial file is not at the expected byte offset.
Wordfence Premium, Care and Response customers received a firewall rule on August 13. Sites running the free version of Wordfence get the same rule on September 12, so for roughly a month the update is the only real protection a free-tier site has.
Upload fields keep turning out to be the way in to WordPress. An Elementor Pro upload bug handed over whole sites in August, and a backup plugin flaw exposed five million more this week. Underneath, the Gravity Forms case is a plainer lesson than either: a value that was safe to trust in one place got trusted in another, and nothing in the code was keeping track of the difference.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.