PoC Index85,079 CVEs with PoCs

CVE-2025-13407

GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload

MEDIUM 6.8EPSS 0.4%

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.

Affected
Gravity Forms
CVSS v3.1 CNA
6.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
0.37% chance of exploitation in the next 30 days, 29th percentile
Published
2025-12-24

Proof-of-concept exploits (3)

References

Related