CVE-2025-12974

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through the chunked upload mechanism. This makes it possible for unauthenticated attackers to upload executable .phar files and achieve remote code execution on the server, granted they can discover or enumerate the upload path. In order for an attacker to achieve RCE, the web server needs to be set up to process .phar file as PHP via file handler mapping or similar.

• CWE-434

• https://docs.gravityforms.com/gravityforms-change-log/
• https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/common/common.php#L4178
• https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/includes/upload.php#L97
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b6395439-da45-4b64-8e30-b106dffd46c1?source=cve

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12969Fluent Bit in_forward input plugin does not properly enforce…6.5
• CVE-2025-1297Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-12970The extract_name function in Fluent Bit in_docker input plug…8.8
• CVE-2025-12971The Folders – Unlimited Folders to Organize Media Library Fo…4.3
• CVE-2025-12972Fluent Bit out_file plugin does not properly sanitize tag va…5.3
• CVE-2025-12973The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & I…7.2
• CVE-2025-12975The CTX Feed – WooCommerce Product Feed Manager plugin for W…7.2
• CVE-2025-12976The Events Manager – Calendar, Bookings, Tickets, and more! …6.4
• CVE-2025-12977Fluent Bit in_http, in_splunk, and in_elasticsearch input pl…9.1
• CVE-2025-12978Fluent Bit in_http, in_splunk, and in_elasticsearch input pl…5.4
• CVE-2025-12979The Welcart e-Commerce plugin for WordPress is vulnerable to…5.3
• CVE-2025-1298Logic vulnerability in the mobile application (com.transsion…9.8