PT-2025-5200 · Gravity Forms · Notfound Multi Uploader For Gravity Forms

Colin Xu · Published 2025-01-22 · Updated 2025-01-22 · CVE-2025-23921

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NotFound Multi Uploader for Gravity Forms versions 1.1.3 and earlier

Description The issue allows unrestricted upload of files with dangerous types, enabling attackers to upload web shells to web servers. This can lead to significant security risks.

Recommendations For versions 1.1.3 and earlier, update to a version later than 1.1.3 to resolve the issue. As a temporary workaround, consider restricting file uploads or disabling the upload feature until a patch is available. Restrict access to the upload module to minimize the risk of exploitation. Avoid using the file upload feature in the affected API endpoint until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-23921

Affected Products

Notfound Multi Uploader For Gravity Forms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-23921 · Security Note
• https://twitter.com/CveFindCom/status/1882081641507545168 · Twitter Post
• https://t.me/cvedetector/16101 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1882123201540476992 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/gf-multi-uploader/vulnerability/wordpress-multi-uploader-for-gravity-forms-plugin-1-1-3-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1882137425214087588 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/gf-multi-uploader/vulnerability/wordpress-multi-uploader-for-gravity-forms-plugin-1-1-3-arbitrary-file-upload-vulnerability?_s_id=cve · Note