PT-2025-52870 · WordPress · Gravity Forms

Marc Montpas · CVE-2025-13407 · Published 2025-12-24 · Updated 2025-12-24

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gravity Forms WordPress plugin versions prior to 2.9.23.1

Description The Gravity Forms WordPress plugin does not properly prevent users from uploading dangerous files through its chunked upload functionality. This allows attackers to upload PHP files to affected sites and achieve Remote Code Execution, provided they can discover or enumerate the upload path.

Recommendations Update Gravity Forms WordPress plugin to version 2.9.23.1 or later.

Exploit

Fix

Related Identifiers

CVE-2025-13407

Affected Products

Gravity Forms

References · 6

• 🔥 https://wpscan.com/vulnerability/e09908fb-f5ad-45ca-8698-c0d596fd39cc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13407 · Security Note
• https://t.me/cveNotify/146736 · Telegram Post
• https://t.me/CVEtracker/40562 · Telegram Post
• https://twitter.com/CVEnew/status/2003721568275615873 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2003741517224046941 · Twitter Post