Gravity Forms versions up to and including 3.1.0.4 are vulnerable to unauthenticated remote code execution due to improper file validation, posing a critical security risk.

This vulnerability is an unrestricted file upload flaw (CWE-434) caused by a validation mismatch in the upload_file function. Unauthenticated attackers can exploit this on any publicly accessible form that contains a hidden File Upload field to upload executable files, leading to full remote code execution.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the underlying web server. Given the CVSS score of 9.8, this represents a critical threat that could lead to complete site compromise, data exfiltration, or the deployment of persistent backdoors within the WordPress environment.

Immediate Action: Update the Gravity Forms plugin to version 3.1.1 or later immediately.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting form submission endpoints, particularly those originating from unknown or unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads containing executable extensions (such as .php, .phtml, or .phar) to mitigate the risk until the update is applied.

Public Exploit Available: No (exploit_available: unknown)

The severity of this vulnerability cannot be overstated given the potential for unauthenticated remote code execution. Administrators should prioritize the update to version 3.1.1 across all instances of Gravity Forms immediately to close the validation gap and prevent unauthorized file persistence.