CVE-2025-12974

Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload

Published Nov 18, 2025 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through the chunked upload mechanism. This makes it possible for unauthenticated attackers to upload executable .phar files and achieve remote code execution on the server, granted they can discover or enumerate the upload path. In order for an attacker to achieve RCE, the web server needs to be set up to process .phar file as PHP via file handler mapping or similar.

Analysis

Technical impact

Gravity Forms, a popular WordPress plugin, is vulnerable to arbitrary file uploads because the legacy chunked upload mechanism performs no file type validation. The extension blacklist mistakenly excludes .phar files, allowing an attacker to upload a .phar payload, which can contain PHP code. If the web server is configured to process .phar files as PHP, the attacker can execute code directly on the server, compromising confidentiality, integrity, and availability.

Affected Systems

The vulnerability affects all users of Gravity Forms versions up to and including 2.9.21.1 running on WordPress sites. The attack surface includes the upload path that the chunked upload routine uses; discovery or enumeration of this path is required for exploitation.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity flaw. The EPSS score of less than 1% suggests that exploitation is unlikely at present, but the lack of a KEV listing does not negate the need for remediation. Attackers could exploit the flaw from any network position without authentication, provided they can find the upload directory, and the server is configured to execute .phar files.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Gravity Forms

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.9.21.1

No data.

Vendor	Product	Versions
Gravityforms	Gravity Forms	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Gravity Forms to a later version that removes or corrects the legacy chunked upload mechanism, if such an update is available.
If an update is not immediately possible, disable legacy chunked uploads or rename the upload directory to a location that is not served by the web server, thereby preventing remote write access.
Configure the web server to explicitly deny execution of .phar files or block the .phar extension using .htaccess or server configuration directives.

Generated by OpenCVE AI on April 21, 2026 at 18:19 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.717% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://docs.gravityforms.com/gravityforms-change-log/
https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/common/common.php#L4178
https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/includes/upload.php#L97
https://www.wordfence.com/threat-intel/vulnerabilities/id/b6395439-da45-4b64-8e30-b106dffd46c1?source=cve

History

Nov 19, 2025 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Nov 18, 2025 9:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Gravityforms Gravityforms gravity Forms Wordpress Wordpress wordpress
Vendors & Products		Gravityforms Gravityforms gravity Forms Wordpress Wordpress wordpress

Nov 18, 2025 3:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through the chunked upload mechanism. This makes it possible for unauthenticated attackers to upload executable .phar files and achieve remote code execution on the server, granted they can discover or enumerate the upload path. In order for an attacker to achieve RCE, the web server needs to be set up to process .phar file as PHP via file handler mapping or similar.
Title		Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload
Weaknesses		CWE-434
References		https://docs.gravityforms.com/gravityforms-change-log/ https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/common/common.php#L4178 https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/includes/upload.php#L97 https://www.wordfence.com/threat-intel/vulnerabilities/id/b6395439-da45-4b64-8e30-b106dffd46c1?source=cve
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`