Arbitrary File Upload Vulnerability in Gravity Forms for WordPress
CVE-2025-12352

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Gravity Forms
Vendor
CVE Published:
7 November 2025

What is CVE-2025-12352?

The Gravity Forms plugin for WordPress suffers from a vulnerability allowing arbitrary file uploads due to inadequate file type validation within the copy_post_image() function. This flaw exists in all versions up to 2.9.20 and permits unauthenticated attackers to upload malicious files to the affected server. The risk is amplified for configurations where allow_url_fopen is enabled, particularly when the post creation form has a file upload field, potentially leading to remote code execution.

Affected Version(s)

Gravity Forms * <= 2.9.20

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://github.com/pronamic/gravityforms/blob/06de1b7e169...
https://github.com/pronamic/gravityforms/blob/06de1b7e169...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Talal Nasraddeen
JSON
.
CVE-2025-12352 : Arbitrary File Upload Vulnerability in Gravity Forms for WordPress