CVE-2025-13407 Details
Description
The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.
A vulnerability in the Gravity Forms WordPress plugin, affecting versions prior to 2.9.23.1, allows for unauthenticated arbitrary file uploads. The plugin's chunked upload feature does not adequately restrict users from uploading potentially harmful files, such as PHP scripts. This flaw could be exploited to achieve remote code execution on the affected site, provided the attacker can identify or enumerate the upload path.
Users are advised to update the Gravity Forms WordPress plugin to version 2.9.23.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 24, 2025CISA-ADP
Assessed Dec 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/e09908fb-f5ad-45ca-8698-c0d596fd39cc/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Gravity Forms | < 2.9.23.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 24, 2025 | CVE Modified | CISA-ADP |
| Dec 24, 2025 | New CVE Received | [email protected] |