PT-2025-45404 · WordPress · Gravity Forms

Talal Nasraddeen

·

Published

2025-11-07

·

Updated

2025-11-14

·

CVE-2025-12352

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Gravity Forms versions up to and including 2.9.20
Description The Gravity Forms plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the copy post image() function. This allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution. This issue is only present on sites where allow url fopen is enabled, the post creation form is active, and a file upload field exists within the post form.
Recommendations Gravity Forms versions up to and including 2.9.20: Update to version 2.9.21 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-12352

Affected Products

Gravity Forms