blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2025-13407

MEDIUM 6.8 CVSS 3.1
Published
December 24, 2025
Last modified
October 19, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.

Affected products and versions

  • Unknown Gravity Forms — Before 2.9.23.1

References

  • wpscan.com https://wpscan.com/vulnerability/e09908fb-f5ad-45ca-8698-c0d596fd39cc/
  • nvd.nist.gov Official NVD record