CVE-2026-119529
Gravity Forms < 3.2.2 - Unauthenticated LFI via Chunked File Upload
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled.
| Vendor | unknown |
| Product | gravity forms |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown gravity forms
Be the first to know when new unknown vulnerabilities affecting unknown gravity forms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Gravity Forms
0 < 3.2.2
References
Credits
endangcamon WPScan