Gravity Forms: Local file inclusion via chunked file upload
Summary
The Gravity Forms WordPress plugin before 3.2.2 does not restrict the file types that unauthenticated users can upload through its chunked file upload feature. On servers that parse Server-Side Include documents, such as Apache with SSI enabled, an attacker can read server environment variables and files within the web root. The attack needs no login but has high complexity, and the impact is limited to confidentiality.
Affected
- Gravity Forms WordPress plugin, all versions before 3.2.2
- Vendor not confirmed in the CVE record (listed as Unknown)
Fixed in
- Version 3.2.2 (per WPScan; not yet confirmed by the vendor changelog)
Workaround
- Unknown (no vendor-confirmed workaround)
- Disable Apache SSI on hosts where it is not required; this removes the file-read impact described in the advisory (not vendor-confirmed)
- Disable the chunked upload feature where possible (suggested by VulDB; not vendor-confirmed)
Exploitation
- No evidence of exploitation in the wild as of 10 Nov 2026 (OffSeq)
- Not listed in CISA KEV; no public exploit code known
- CISA SSVC: exploitation none, automatable no, technical impact partial
Our recommendation
- Inventory WordPress sites running Gravity Forms and identify versions below 3.2.2
- Update to 3.2.2 or later after checking the official plugin changelog
- Check whether Apache SSI is enabled on affected hosts and disable it if it is not needed
- Review the Gravity Forms upload directories for unexpected files
- Monitor NVD, CISA KEV and the WPScan advisory for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory for CVE-2026-119529 wpscan.com
- CVE Record CVE-2026-119529 www.cve.org
- WPScan plugin page Gravity Forms wpscan.com
- OffSeq threat radar entry for CVE-2026-119529 radar.offseq.com
- VulDB entry for CVE-2026-119529 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:54.
Original description (NVD)
The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.