Arbitrary File Upload Vulnerability in Gravity Forms for WordPress
CVE-2025-12352
9.8CRITICAL
What is CVE-2025-12352?
The Gravity Forms plugin for WordPress suffers from a vulnerability allowing arbitrary file uploads due to inadequate file type validation within the copy_post_image() function. This flaw exists in all versions up to 2.9.20 and permits unauthenticated attackers to upload malicious files to the affected server. The risk is amplified for configurations where allow_url_fopen is enabled, particularly when the post creation form has a file upload field, potentially leading to remote code execution.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Gravity Forms * <= 2.9.20
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Talal Nasraddeen