CVE-2026-119529 · Runtime
NO FIX YET · SEE WHAT TO DO
The Gravity Forms WordPress plugin before 3.2.2 accepts file types from unauthenticated users through its chunked upload feature without proper restriction. On servers that parse Server-Side Include documents, such as Apache with SSI enabled, an attacker can read server environment variables and files inside the web root.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Gravity Forms WordPress plugin older than 3.2.2 that have the chunked upload feature reachable by visitors and a web server that parses Server-Side Include documents, such as Apache with SSI enabled. Sites without the plugin, on patched versions, or without SSI parsing are not exposed by the source's description.
Not affected if no-public-upload-forms, plugin-at-3.2.2-or-later, ssi-disabled
Who cares apache, gravity-forms, self-hosted, wordpress
3.2.2.apachectl -M | grep include), since the attack depends on SSI parsing.3.2.2 or later.The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.