CVE-2025-12352: 
WordPress vulnerability analysis and mitigation

The Gravity Forms plugin for WordPress contains a critical vulnerability (CVE-2025-12352) that allows arbitrary file uploads due to missing file type validation in the copy_post_image() function. This vulnerability affects all versions up to and including 2.9.20. The issue was discovered and reported by Wordfence, with initial disclosure on November 7, 2025 (NVD).

The vulnerability stems from insufficient file type validation in the copy_post_image() function, which can be exploited by unauthenticated attackers. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating the highest severity level. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD).

The vulnerability allows unauthenticated attackers to upload arbitrary files to the affected site's server, potentially enabling remote code execution. This impact is particularly severe for sites that have allow_url_fopen set to 'On', with the post creation form enabled along with a file upload field for the post (NVD).