PT-2025-47239 · WordPress · Gravity Forms

Talal Nasraddeen · Published 2025-11-18 · Updated 2025-11-23 · CVE-2025-12974

Positive Technologies · (AI Summary)

CVSS v3.1

8.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 2.9.22

Description The Gravity Forms plugin for WordPress is susceptible to arbitrary file uploads because of inadequate file type validation within the legacy chunked upload mechanism. The extension blacklist does not include .phar files, allowing unauthenticated attackers to upload executable .phar files. Successful exploitation requires the web server to be configured to process .phar files as PHP. This could lead to remote code execution on the server if an attacker can determine the upload path.

Recommendations Update Gravity Forms to version 2.9.22 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-12974

Affected Products

Gravity Forms

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-12974 · Security Note
• https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/common/common.php#L4178 · Note
• https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/includes/upload.php#L97 · Note
• https://docs.gravityforms.com/gravityforms-change-log · Note
• https://twitter.com/RedPacketSec/status/1990806223348797534 · Twitter Post
• https://twitter.com/VolerionSec/status/1990635837722095847 · Twitter Post
• https://twitter.com/CveTodo/status/1990638176558276856 · Twitter Post
• https://twitter.com/CVEnew/status/1990631579912450399 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1990662190617989601 · Twitter Post
• https://t.me/cveNotify/143140 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b6395439-da45-4b64-8e30-b106dffd46c1?source=cve · Note
• https://twitter.com/cracbot/status/1992548732429308292 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1990705537487343689 · Twitter Post
• https://t.me/CVEtracker/37572 · Telegram Post