CVE-2025-13407

CVE-2025-13407

Medium · published December 24, 2025

CVSS v3.1
6.8
EPSS
0%
Percentile
29.6
In the wild
Unconfirmed
What it is

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00369 · 29.6th percentile
Published
2025-12-24T11:15Z
References (1)
https://wpscan.com/vulnerability/e09908fb-f5ad-45ca-8698-c0d596fd39cc/ · [email protected]
EPSS history
Timeline
  • 24 DEC 06:00Z
    GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload
    cvelistv5