A critical vulnerability in Gravity Forms, identified as CVE-2026-84434, was reportedly exploited in the wild on September 18, 2026, a day before its official publication date of September 19, 2026. This pre-disclosure exploitation means there was no patch window for users to apply fixes before attacks began.
The flaw is described as an unrestricted file upload vulnerability, which could allow attackers to upload malicious files to a website running Gravity Forms. Such a vulnerability often leads to remote code execution, enabling full control over the affected site.
While the vulnerability is listed in the VulnCheck KEV (Known Exploited Vulnerabilities) catalog, it has not been added to the CISA KEV (U.S. federal) or EUVD (European Union) lists. The VulnCheck KEV entry, dated September 18, 2026, is currently the sole public corroboration of its active exploitation.
The CVE record for CVE-2026-84434 was initially reserved on September 1, 2026, with the public disclosure occurring 18 days later. The earliest reported exploitation activity coincides with the first KEV listing, indicating immediate weaponization of the vulnerability.
Gravity Forms is a popular WordPress plugin used for creating various types of forms, including contact forms, surveys, and order forms. Its widespread use makes any critical vulnerability a significant concern for a large number of websites.
Users of Gravity Forms are advised to ensure their installations are updated to the latest available version to mitigate the risk posed by this exploited vulnerability. Details regarding the specific versions affected and the patched version were not immediately available in the public reports.
