CVE-2026-94120

Summary

GravityExport Lite for Gravity Forms allows unauthenticated users to bypass access controls and access restricted functionality, potentially leading to sensitive data exposure. This represents a critical authorization flaw that affects all versions up to 2.7.2.

Exploitability

Exploitation is straightforward with no prerequisites required since the vulnerability affects unauthenticated access to protected endpoints.

Blast radius

The impact could be significant as attackers can access export functionality without authentication, potentially exposing sensitive form data and user information processed through Gravity Forms.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.7.3 or later to remediate this broken access control vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.