CVE-2025-12352criticalobserved exploitationCWE-434

CVE-2025-12352: critical vulnerability in Gravity Forms

Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'

Published · Updated

Follow this CVE+ Monitor Gravity Forms

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 9.8epss 1.1%
from disclosure to weapon
Published on NVDNov 7
VulnCheck+228d
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This only impacts sites that have allow_url_fopen set to `On`, the post creation form enabled along with a file upload field for the post
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Gravity Forms · Gravity Forms
Related CVEs — Gravity Forms

In the same product, most dangerous first.

CVE-2026-84434CRITICALGravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload FieldEPSS 3.9%CVE-2026-12997HIGHGravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' ParameterEPSS 0.9%CVE-2025-12974HIGHGravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked UploadEPSS 0.7%CVE-2026-19513HIGHGravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash ConfusionEPSS 0.7%CVE-2026-103039CRITICALGravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom FieldEPSS 0.5%CVE-2026-4406MEDIUMGravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' ParameterEPSS 0.4%