CVE-2025-12352
BaseFortify
Publication date: 2025-11-07
Last updated on: 2025-11-12
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pronamic | gravity_forms | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Gravity Forms plugin for WordPress has a vulnerability in the copy_post_image() function that lacks proper file type validation. This allows unauthenticated attackers to upload arbitrary files to the server if certain conditions are met, such as having allow_url_fopen enabled, the post creation form active, and a file upload field present. This can potentially lead to remote code execution on the affected site.
How can this vulnerability impact me? :
This vulnerability can allow attackers to upload malicious files to your server without authentication, which may lead to remote code execution. This means attackers could take control of your website, steal data, deface the site, or use the server for further attacks.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Gravity Forms plugin to a version later than 2.9.20 where the issue is fixed. Additionally, ensure that the PHP setting allow_url_fopen is set to Off if possible, and disable the post creation form or remove file upload fields until the plugin is updated.