CVE-2025-13407

CVE-2025-13407CVE-2025-13407

Description

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.

Scoring

CVSS 6.8 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Last modified2026-10-19
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.