Filtered by category: WordFence, tag: gravity forms × Clear
Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms
Matched: WordPress
Wordfence discovered a high-severity arbitrary file upload vulnerability (CVE-2026-19513) in Gravity Forms, a WordPress plugin with over one million installations. Unauthenticated attackers can exploit a cryptographic hash confusion flaw to upload files with attacker-chosen extensions, potentially enabling remote code execution. The flaw was patched in version 3.0.3, released August 20, 2026. Users should update immediately.