Gravity Forms Integration Security Review

Gravity Forms validates that a submitted value matches the form’s stored configuration, but that check is bypassed entirely when the field allows dynamic population.

One setting switches off Gravity Forms’ tamper check

Gravity Forms generates a state when a form is displayed, based on its configuration and allowed values, and checks submitted data against that state on submission. Gravity Forms’ own documentation confirms this check is bypassed when dynamic population is enabled for a field, so a price, a hidden value or a restricted choice populated dynamically loses that protection. We test which fields use dynamic population and what a submission can be made to say once it does.

Uploaded files are saved into a subfolder of the Gravity Forms uploads directory named with the same salted HMAC-MD5 algorithm WordPress itself uses, which makes the folder hard to guess, and an empty index.html file in each one blocks directory listing on a misconfigured server. We test whether an upload form still requires the login Gravity Forms recommends, and whether the file itself is validated before it is stored.

The REST API authenticates with API Keys over Basic Authentication or OAuth 1.0a, generated from the REST API settings page and separate from any WordPress user password. We test what an exposed API Key can read or submit, and whether it reaches more forms and entries than your integration needs.