CVE-2025-13407

MediumCVSS 6.8/10Last modified Oct 19, 2026

Description

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
Unknown	Gravity Forms	< 2.9.23.1

References

https://wpscan.com/vulnerability/e09908fb-f5ad-45ca-8698-c0d596fd39cc/

Timeline

Published: Dec 24, 2025
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-134084.3The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to Cross-Site Request Fo CVE-2025-134094.9The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to SQL Injection via the 'params' parameter in all versions u CVE-2025-13418.1A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. This affects an unknown part of the component Setting Handle CVE-2025-134109.8A vulnerability has been found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected is an unknown function of the file /admin/rece CVE-2025-134119.8A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this vulnerability is an unknown functionality o CVE-2025-134126.1A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of CVE-2025-134134.3The Country Blocker for AdSense plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. CVE-2025-134145.3The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on CVE-2025-134155.4A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SV CVE-2025-134164.3The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized user suspension due to a missing CVE-2025-134178.6The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing su CVE-2025-134186.4The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'plan_icons' parameter in all version