CVE-2025-13407

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.

CVSS v3.1

6.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.36% chance of exploitation in the next 30 days, 29th percentile

Published

2025-12-24

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/e09908fb-f5ad-45ca-8698-c0d596fd39cc/
• xxconi/CVE-2025-13407

References

• CVE Record
• NVD entry

Related

• CVE-2025-5947
• CVE-2025-6254
• CVE-2026-10735
• CVE-2026-12415
• CVE-2026-12416
• CVE-2026-22356