The Gravity Forms plugin for WordPress contains an arbitrary file upload vulnerability that may allow unauthenticated attackers to achieve remote code execution.

This is an unrestricted file upload vulnerability (CWE-434) caused by an insufficient extension blacklist in the plugin's legacy chunked upload process. An unauthenticated attacker can upload executable .phar files to the server, which may lead to remote code execution if the server environment is configured to process .phar files as PHP.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the underlying web server. This poses a critical risk to the confidentiality, integrity, and availability of the entire WordPress site, potentially leading to total system compromise, data exfiltration, or the deployment of persistent backdoors. While the CVSS score is 8.1, the potential for remote code execution makes this a high priority for remediation.

Immediate Action: Update the Gravity Forms plugin to the latest available version that includes the fix for this issue.

Proactive Monitoring: Monitor server access logs for suspicious requests to upload directories or attempts to access .phar files directly.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized file uploads and requests targeting the legacy chunked upload endpoint.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability represents a severe threat to the security of your WordPress environment. Administrators should verify their current version of Gravity Forms immediately and apply the vendor patch. If an immediate update is not feasible, restrict access to the upload functionality or disable the plugin until a secure version can be deployed.