Gravity Forms WordPress Plugin Arbitrary File Upload Vulnerability

The Gravity Forms plugin for WordPress is vulnerable to an Arbitrary File Upload flaw in all versions up to and including 3.1.0.4, via the upload_file function.

The issue stems from a mismatch between the field validation pipeline and the file persistence pipeline. Hidden file upload fields bypass extension validation, and a rejected file's intact upload state is later passed to upload_file() without re-validation.

• Affected versions: all versions up to and including 3.1.0.4
• Precondition: the targeted form must contain a File Upload field with Visibility set to 'Hidden'
• Impact: unauthenticated attackers can upload potentially executable files, leading to remote code execution