CVE Database /
CVE-2025-13407
CVE · Medium
CVE-2025-13407 — Gravity Forms [gravityforms] < 2.9.23.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-13407
|
Gravity Forms [gravityforms] < 2.9.23.1 |
Unrestricted Upload of File with Dangerous Type |
Medium
6.8
|
< 2.9.23.1
|
2.9.23.1 |
2025-12-03 |
—
|
CVE-2025-13407
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 2.9.23.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Source:
Wordfence
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings