CVE-2025-13407 GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload
Unauthenticated attackers can upload PHP files via chunked upload functionality to achieve Remote Code Execution on sites using Gravity Forms.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13407?
CVE-2025-13407 is a medium-severity vulnerability in Unknown Gravity Forms, published on 24 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.
Which versions are affected by CVE-2025-13407?
How do I fix CVE-2025-13407?
No fix has been published for CVE-2025-13407 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-13407 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-13407 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-f7m4-f638-5p2j.