Arbitrary File Upload Vulnerability in Gravity Forms Plugin by WordPress

CVE-2025-12974

What is CVE-2025-12974?

The Gravity Forms plugin for WordPress exhibits a security vulnerability that allows for arbitrary file uploads due to inadequate file type validation within its legacy chunked upload mechanism. This issue affects all versions up to and including 2.9.21.1. Specifically, the extension blacklist fails to account for .phar files, enabling unauthenticated attackers to upload malicious executable files. If the web server is configured to process .phar files as PHP, this vulnerability could lead to remote code execution, contingent on the attacker identifying or enumerating the upload path.

References