---
id: "CVE-2026-119529"
page: "https://infrastack.ai/live/CVE-2026-119529"
kind: "vulnerability"
aliases: ["CVE-2026-119529"]
title: "Gravity Forms WordPress plugin: unauthenticated upload lets attackers read server files"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache", "gravity-forms", "runtime", "self-hosted", "wordpress"]
not_affected_if: ["no-public-upload-forms", "plugin-at-3.2.2-or-later", "ssi-disabled"]
published_at: "2026-11-11T06:17:16+00:00"
first_seen_at: "2026-11-11T06:25:41+00:00"
updated_at: "2026-11-11T06:27:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119529", "first_seen_at": "2026-11-11T06:25:41+00:00"}]
exploit_sources: []
---

# Gravity Forms WordPress plugin: unauthenticated upload lets attackers read server files

Link for people: https://infrastack.ai/live/CVE-2026-119529 (this .md is for agents)

The Gravity Forms WordPress plugin before 3.2.2 accepts file types from unauthenticated users through its chunked upload feature without proper restriction. On servers that parse Server-Side Include documents, such as Apache with SSI enabled, an attacker can read server environment variables and files inside the web root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Gravity Forms version in the WordPress admin plugin list; it is affected below `3.2.2`.
- Check whether Apache SSI is enabled (for example `apachectl -M | grep include`), since the attack depends on SSI parsing.

## Fix

- Gravity Forms: move to `3.2.2` or later.

## Timeline

- 2026-11-11T06:25:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119529

## From the sources

The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_