CVE-2025-12974

🗓️ 18 Nov 2025 03:27:07Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 19 Views

Unauthenticated file upload in Gravity Forms up to 2.9.21.1 via legacy chunked upload enables remote code execution with phar files.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2025-12974	18 Nov 202505:18	–	circl
CNNVD	WordPress plugin Gravity Forms 代码问题漏洞	18 Nov 202500:00	–	cnnvd
Cvelist	CVE-2025-12974 Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload	18 Nov 202503:27	–	cvelist
EUVD	EUVD-2025-197911	18 Nov 202506:30	–	euvd
NVD	CVE-2025-12974	18 Nov 202504:15	–	nvd
OSV	CVE-2025-12974	18 Nov 202504:15	–	osv
Patchstack	WordPress Gravity Forms plugin <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload vulnerability	17 Nov 202522:00	–	patchstack
Positive Technologies	PT-2025-47239	18 Nov 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12974	19 Nov 202504:16	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2025-12974	17 Nov 202500:00	–	vulncheck_kev

Vulners

Node

infusionsoft_gravity_forms_project infusionsoft_gravity_formsRange≤2.9.21.1wordpress

[
  {
    "vendor": "Gravity Forms",
    "product": "Gravity Forms",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.9.21.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/common/common.php
github	www.github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/includes/upload.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/b6395439-da45-4b64-8e30-b106dffd46c1
docs	www.docs.gravityforms.com/gravityforms-change-log/

15 Apr 2026 00:35Current

7.3High risk

Vulners AI Score7.3

CVSS 3.18.1

EPSS0.0023

SSVC