Gravity Forms Edit Entries WP Registry grade F. Critical findings · 2 findingsWP RegistryCritical findings · 2 findingsOpen the reportF

Critical findings.

Audited release

1.9.1

Findings

2

Worst severity

critical

Content hash

5fad1f3995ee05fe64ebd485… Copy

Findings

• critical Unauthenticated arbitrary Gravity Forms entry overwrite via gfee_entry_id

  auth_bypass

  On any request where $_POST['gfee_entry_id'] is non-empty, the plugin hooks gform_after_submission and copies the newly submitted temporary entry onto the entry ID taken directly from POST, then deletes the temp entry. There is no login, nonce, capability, or ownership check. The source comment explicitly notes the IDOR. Any visitor who can submit a form that includes the hidden field (injected by gfee_form_tag whenever GFEE::$entry_id is set, or forged in POST) can overwrite another user's entry and delete associated uploads.

  gravity-forms-edit-entries.php:17-24,235-316

  Recommendation

  Require authentication and prove the current user owns the entry (or has gravityforms_edit_entries). Bind entry_id server-side with a signed token/nonce; never trust raw POST gfee_entry_id.

• high Unauthenticated entry disclosure via entry_id query parameter and JS dump

  information_disclosure

  gf_edit_entries_shortcode accepts $_GET['entry_id'] (or shortcode entry_id) without auth, loads GFAPI::get_entry, pre-fills the form, and gfee_output_json echoes the full entry as var gfee_entry = {...} into the page. Attackers can enumerate entry IDs on any public page containing the shortcode.

  gravity-forms-edit-entries.php:41-43,110-206

  Recommendation

  Restrict entry loading to the owning user or privileged roles; do not dump raw entry JSON to the client.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.