{"id":"CVE-2026-119529","kind":"vulnerability","aliases":["CVE-2026-119529"],"related":[],"title":"Gravity Forms WordPress plugin: unauthenticated upload lets attackers read server files","description":"The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled.","summary":"The Gravity Forms WordPress plugin before 3.2.2 accepts file types from unauthenticated users through its chunked upload feature without proper restriction. On servers that parse Server-Side Include documents, such as Apache with SSI enabled, an attacker can read server environment variables and files inside the web root.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache","gravity-forms","runtime","self-hosted","wordpress"],"not_affected_if":["no-public-upload-forms","plugin-at-3.2.2-or-later","ssi-disabled"],"how_to_check":"- Check the installed Gravity Forms version in the WordPress admin plugin list; it is affected below `3.2.2`.\n- Check whether Apache SSI is enabled (for example `apachectl -M | grep include`), since the attack depends on SSI parsing.","fix":"- Gravity Forms: move to `3.2.2` or later.","status":"open","published_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","triaged_at":"2026-11-11T06:27:37+00:00","updated_at":"2026-11-11T06:27:37+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T06:27:37Z","model":"claude-haiku-5-5","output":{"fix":"- Gravity Forms: move to `3.2.2` or later.","reach":"internet","title":"Gravity Forms WordPress plugin: unauthenticated upload lets attackers read server files","impact":"medium","summary":"The Gravity Forms WordPress plugin before 3.2.2 accepts file types from unauthenticated users through its chunked upload feature without proper restriction. On servers that parse Server-Side Include documents, such as Apache with SSI enabled, an attacker can read server environment variables and files inside the web root.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","gravity-forms","apache","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads environment variables and web root files, including secrets","analyst_note":"Confirm the affected version range and fixed version against the NVD entry or the vendor advisory, since only the 'before 3.2.2' wording is in the sources.","how_to_check":"- Check the installed Gravity Forms version in the WordPress admin plugin list; it is affected below `3.2.2`.\n- Check whether Apache SSI is enabled (for example `apachectl -M | grep include`), since the attack depends on SSI parsing.\n- unknown for further checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-at-3.2.2-or-later","ssi-disabled","no-public-upload-forms"],"who_is_affected":"Sites running the Gravity Forms WordPress plugin older than `3.2.2` that have the chunked upload feature reachable by visitors and a web server that parses Server-Side Include documents, such as Apache with SSI enabled. Sites without the plugin, on patched versions, or without SSI parsing are not exposed by the source's description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000792,"input_tokens":4557,"output_tokens":672,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119529':14A,17A '-2026':13A,16A '3.2.2':33B,82C 'accept':34B 'allow':101C 'apach':18B,59B,129C 'attack':8A,64B 'chunk':42B,97C 'configur':119C 'content':110C 'cve':12A,15A 'document':56B,126C 'enabl':62B,132C 'environ':68B,106C 'featur':44B,100C 'file':11A,35B,71B,88C,98C,112C 'form':2A,21B,29B,78C 'graviti':1A,20B,28B,77C 'gravity-form':19B 'host':25B 'includ':55B,125C 'insid':72B 'let':7A 'pars':51B,121C 'plugin':4A,31B,80C 'proper':46B,85C 'read':9A,66B,104C 'restrict':47B,86C 'root':75B,116C 'runtim':22B 'self':24B 'self-host':23B 'server':10A,49B,53B,67B,105C,118C,123C 'server-sid':52B,122C 'side':54B,124C 'ssi':61B,131C 'type':36B,89C 'unauthent':5A,38B,91C 'upload':6A,43B,94C,99C 'user':39B,92C 'variabl':69B,107C 'web':74B,115C 'within':113C 'without':45B 'wordpress':3A,26B,30B,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gravity Forms WordPress plugin older than `3.2.2` that have the chunked upload feature reachable by visitors and a web server that parses Server-Side Include documents, such as Apache with SSI enabled. Sites without the plugin, on patched versions, or without SSI parsing are not exposed by the source's description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apache","gravityforms","high","runtime","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119529':14A,17A '-2026':13A,16A 'attack':8A 'cve':12A,15A 'file':11A 'form':2A 'graviti':1A 'let':7A 'plugin':4A 'read':9A 'server':10A 'unauthent':5A 'upload':6A 'wordpress':3A","search_b":"'3.2.2':33B 'accept':34B 'apach':18B,59B 'attack':64B 'chunk':42B 'document':56B 'enabl':62B 'environ':68B 'featur':44B 'file':35B,71B 'form':21B,29B 'graviti':20B,28B 'gravity-form':19B 'host':25B 'includ':55B 'insid':72B 'pars':51B 'plugin':31B 'proper':46B 'read':66B 'restrict':47B 'root':75B 'runtim':22B 'self':24B 'self-host':23B 'server':49B,53B,67B 'server-sid':52B 'side':54B 'ssi':61B 'type':36B 'unauthent':38B 'upload':43B 'user':39B 'variabl':69B 'web':74B 'without':45B 'wordpress':26B,30B","search_c":"'3.2.2':82C 'allow':101C 'apach':129C 'chunk':97C 'configur':119C 'content':110C 'document':126C 'enabl':132C 'environ':106C 'featur':100C 'file':88C,98C,112C 'form':78C 'graviti':77C 'includ':125C 'pars':121C 'plugin':80C 'proper':85C 'read':104C 'restrict':86C 'root':116C 'server':105C,118C,123C 'server-sid':122C 'side':124C 'ssi':131C 'type':89C 'unauthent':91C 'upload':94C,99C 'user':92C 'variabl':107C 'web':115C 'within':113C 'wordpress':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119529","severity":null,"published_at":"2026-11-11T06:17:16+00:00","modified_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","fetched_at":"2026-11-11T06:25:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}