PT-2025-52870

CVE-2025-13407

·

Published

2025-12-03

·

Updated

2025-12-24

Description by

CVSS 3.1
6.8
Medium
MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Gravity Forms WordPress plugin versions prior to 2.9.23.1
Description The Gravity Forms WordPress plugin does not properly prevent users from uploading dangerous files through its chunked upload functionality. This allows attackers to upload PHP files to affected sites and achieve Remote Code Execution, provided they can discover or enumerate the upload path.
Recommendations Update Gravity Forms WordPress plugin to version 2.9.23.1 or later.
Exploitability
Exploit
Fix
Researchers
Vendors
Affected products
Related identifiers
CVE-2025-13407
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com