Introduction
Attackers can upload arbitrary files to WordPress sites running Gravity Forms up to version 2.9.20. If the server has allow_url_fopen enabled and the site has a post creation form with a file upload field, this can lead to remote code execution. The vulnerability is tracked as CVE-2025-12352, carries a critical CVSS score of 9.8, and affects one of the most widely deployed form plugins in the WordPress ecosystem.
RocketGenius develops Gravity Forms. Organizations of all sizes use it for lead generation, content submission, and complex workflow automation. The plugin's broad feature set and integrations have made it a high-value target for attackers, more so given its history of security issues, including file upload and cross-site scripting vulnerabilities and a recent supply chain compromise.
Technical Information
CVE-2025-12352 comes from missing file type validation in the copy_post_image() function of Gravity Forms up to and including version 2.9.20. The vulnerability is triggered when a WordPress site has a Gravity Forms form with the post creation feature enabled and a Post Image field. If the server's PHP configuration has allow_url_fopen set to On, the function copies files from external URLs into the WordPress uploads directory without checking the file type or extension. Unauthenticated attackers can use this to upload arbitrary files to the server, including executable PHP scripts.
The vulnerable code path is publicly referenced in the Gravity Forms source code:
// forms_model.php (see reference) copy_post_image() // lacks file type validation
If the web server executes files from the uploads directory, an attacker can get remote code execution by requesting the uploaded file directly. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type).
Affected Systems and Versions
- Gravity Forms for WordPress, all versions up to and including 2.9.20
- Vulnerable only if:
- The site has a form with post creation enabled and a Post Image field
- PHP allow_url_fopen is set to On
Vendor Security History
Gravity Forms has a history of security issues, including:
- Arbitrary file upload vulnerability in 2015
- Multiple cross-site scripting vulnerabilities in recent years
- SQL injection vulnerabilities
- A supply chain compromise in July 2025, where attackers injected malicious code into the plugin repository
The vendor usually responds promptly to reported vulnerabilities with patches and security advisories. Still, file upload and other critical issues keep recurring, which points to a need for stronger code review and security testing.
