External risk intelligence

Gravity Forms Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-12352

This vulnerability affects a WordPress plugin, which is a component of public-facing web applications. The entry point is a web form designed to be accessible to users over the internet to upload files, making it a public-facing web interface by design.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Gravity Forms plugin for WordPress could allow unauthorized users to upload malicious files to a website's server. This could potentially lead to the execution of arbitrary code, impacting the integrity and availability of the affected site. The primary concern at this stage is to confirm if this plugin is in use and if the specific configuration is vulnerable.

Allows uploading malicious files.
Potential for unauthorized code execution.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

Attackers can upload arbitrary files to a website by exploiting a weakness in how a WordPress plugin handles file uploads. This is possible without needing any login credentials if the site is configured with specific settings that allow remote file inclusion and have a form with a file upload field enabled. Successful exploitation could allow an attacker to execute code on the server.

Unauthenticated access to a web form.
Uploading a specially crafted file.
Potential for remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory's conditions, unauthenticated attackers could upload arbitrary files to the server, potentially enabling remote code execution on the affected site.

Arbitrary files can be uploaded.
Malicious files via upload fields.
Server compromise and remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world remediation for this vulnerability begins with identifying which teams manage the WordPress instances utilizing the Gravity Forms plugin. Typically, application owners or platform teams are responsible for plugin integrity, while network and security teams should confirm external accessibility and potential exposure. The first practical step involves a comprehensive inventory of all WordPress sites, followed by an assessment of reachability and business criticality for each, to prioritize remediation efforts and identify the accountable owner for each affected instance.

Application or platform teams own the issue.
Verify WordPress site inventory and plugin reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Gravity Forms plugin for WordPress?

Gravity Forms is a widely used plugin for WordPress that allows site administrators to build custom web forms. It is frequently employed to collect user data, such as contact inquiries, file submissions, or posts generated from front-end forms, integrating directly into the WordPress site architecture to process and store that information.

What does CWE-434 mean regarding CVE-2025-12352?

CWE-434 identifies a weakness where software allows the upload of files without properly checking their type. In this CVE, the plugin fails to validate incoming files, which means the server might accept a malicious file disguised as a harmless one, potentially allowing an attacker to run unauthorized commands on the underlying system.

How does an attacker trigger this vulnerability?

An attacker targets a site by using a form designed for post creation that includes a file upload field. This is only possible if the site has the PHP setting allow_url_fopen enabled. If these specific form features and server settings are not active, the vulnerability cannot be triggered through this path.

Do I need to worry if my site is not internet-facing?

Halo Surface Signal indicates that because this vulnerability involves public-facing web forms, internet-accessible sites are at higher risk. If your WordPress site is strictly internal and unreachable from the internet, the potential for unauthenticated exploitation is significantly reduced, though you should still verify your plugin configuration.

What should I do first if I use Gravity Forms?

Start by confirming if your WordPress instances have the Gravity Forms plugin installed. Next, identify if you are using post creation forms that include file upload fields and verify your server's allow_url_fopen configuration. Once these are identified, coordinate with your application teams to assess the risk and plan necessary updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.