Introduction
Attackers can gain remote code execution on WordPress sites running Gravity Forms by uploading a specially crafted .phar file through a legacy chunked upload endpoint. The plugin is deployed on millions of sites, so the flaw is a significant risk for any organization that relies on Gravity Forms for file handling or user submissions.
Gravity Forms, developed by RocketGenius, is a dominant form management plugin for WordPress. Businesses of all sizes use it for contact forms, lead generation, and complex workflow automation. Because it is so widely deployed and so often wired into critical business processes, a vulnerability in Gravity Forms has far-reaching consequences across the WordPress ecosystem.
Technical information
CVE-2025-12974 is a flaw in the legacy chunked upload mechanism of Gravity Forms, present in all versions up to and including 2.9.21.1. The plugin restricts dangerous file types on upload with a blacklist, and that blacklist did not include the .phar extension. A .phar file is a PHP archive that can contain executable PHP code, and attackers could upload one without the check stopping it. The validation logic is in the plugin's common.php and upload.php files.
No authentication is required. An attacker can submit a .phar file through a form that uses the legacy chunked upload endpoint. If the web server is configured to execute .phar files as PHP (through handler mappings, for example), requesting the uploaded file runs the embedded PHP code. The result is remote code execution in the context of the web server process.
The root cause is the incomplete extension blacklist in the upload handler. The code responsible for this validation is publicly available:
// Reference: https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/common/common.php#L4178 $blacklist = array('php', 'exe', 'jsp', ... ); // .phar missing
// Reference: https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/includes/upload.php#L97 if ( in_array( $extension, $blacklist ) ) { // Reject upload }
Because .phar is not on the blacklist, the upload goes through and the file is written to a predictable location in the uploads directory. The attacker still has to discover or guess the upload path, which may take brute force or information disclosure techniques. Once the path is known, a direct request to the .phar file triggers code execution if the server executes .phar files as PHP.
The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type).
Affected systems and versions
- Gravity Forms for WordPress, all versions up to and including 2.9.21.1
- The vulnerability is in the legacy chunked upload mechanism
- Exploitation requires the web server to be configured to execute .phar files as PHP
Vendor security history
Gravity Forms has a history of file upload vulnerabilities and related security issues. CVE-2025-12352, for one, allowed arbitrary file uploads through the copy_post_image function. In July 2025 the plugin also suffered a supply chain compromise in which malicious code was injected into its downloadable packages. The vendor usually releases patches quickly after disclosure, but the recurring file upload flaws point to ongoing gaps in secure development practices and input validation.
