Description

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-30T13:17:24.363Z",
  "pubdate": "2026-09-30T13:17:24.363Z",
  "executiveSummary": "GravityExport Lite for Gravity Forms, in versions 2.7.2 and below, is affected by an unauthenticated broken access control vulnerability. This security flaw allows unauthenticated remote attackers to bypass authorization checks to access or export sensitive form entry data.\nThe vulnerability resides in the plugin's access control logic, which fails to properly validate the identity or permissions of the user requesting data exports. This enables unauthorized actors to intercept or download form submissions without prior authentication or administrative privileges.\nThe risk implication is significant as it facilitates unauthorized data exfiltration, potentially exposing personally identifiable information (PII) or sensitive business data collected via Gravity Forms. Successful exploitation requires no specialized user interaction or authenticated session, posing a high risk to data confidentiality. Attackers can leverage this flaw by sending crafted requests directly to the affected endpoint, effectively automating the retrieval of restricted records.",
  "technicalDetails": "The root cause of the vulnerability in GravityExport Lite <= 2.7.2 is the improper implementation of access control checks within the plugin's export processing logic. The affected component fails to adequately verify the requester's identity, permissions, or session validity before executing data retrieval operations.\nIn a standard deployment of GravityExport Lite, the plugin registers specific endpoints or hooked functions to handle the export of Gravity Forms entries. Due to the lack of sufficient authorization checks, the code path that initiates the export process does not enforce the requirement for a valid, authorized session. Consequently, the application processes incoming requests as if they were initiated by an authenticated administrative user.\nThe attack flow involves an external, unauthenticated actor identifying the public-facing or internal endpoint used by the plugin for data exporting. By crafting a specific HTTP request targeting this endpoint, the attacker can manipulate the parameters to specify the desired form ID or export scope. Because the server-side code performs no verification, it proceeds to query the database, assemble the requested entries, and return the data—frequently in formats like CSV or Excel—directly to the attacker.\nThis vulnerability is classified as broken access control because the application logic trusts the request origin without validation. The attack vector is purely network-based and can be executed over HTTP or HTTPS protocols. Post-exploitation impact is severe, as it allows for bulk data exfiltration of any forms managed by the plugin. Attackers can iterate through form IDs to extract comprehensive datasets, potentially compromising user privacy and violating regulatory compliance standards such as GDPR or HIPAA, depending on the nature of the collected data. Since the exploit does not trigger typical authentication failure logs, it may go undetected during standard security monitoring unless specific behavioral analysis on export traffic is performed."
}