CVE-2025-12974highexplotación observadaCWE-434

CVE-2025-12974: fallo de gravedad alta en Gravity Forms

Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Gravity Forms

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

43Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Actcvss 8.1epss 0.7%
de la publicación al arma
Publicada en NVD18 nov
VulnCheck17 nov
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through the chunked upload mechanism. This makes it possible for unauthenticated attackers to upload executable .phar files and achieve remote code execution on the server, granted they can discover or enumerate the upload path. In order for an attacker to achieve RCE, the web server needs to be set up to process .phar file as PHP via file handler mapping or similar.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Gravity Forms · Gravity Forms
CVEs relacionadas — Gravity Forms

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-84434CRITICALGravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload FieldEPSS 3.9%CVE-2025-12352CRITICALGravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'EPSS 1.1%CVE-2026-12997HIGHGravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' ParameterEPSS 0.9%CVE-2026-19513HIGHGravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash ConfusionEPSS 0.7%CVE-2026-103039CRITICALGravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom FieldEPSS 0.5%CVE-2026-4406MEDIUMGravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' ParameterEPSS 0.4%