Atomic Edge analysis of CVE-2025-12974 (metadata-based): This vulnerability is an unauthenticated arbitrary file upload in Gravity Forms versions up to and including 2.9.21.1, specifically within the legacy chunked upload mechanism. The plugin fails to properly validate file extensions, allowing uploads of .phar files because its extension blacklist does not include this executable type. Attackers can upload a malicious .phar file and, if the server is configured to execute .phar as PHP, achieve remote code execution. The CVSS score is 8.1 (High), with network vector, high attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability.
Root Cause: The root cause aligns with CWE-434 (Unrestricted Upload of File with Dangerous Type). Atomic Edge analysis infers that the legacy chunked upload handler implements a blacklist of disallowed extensions but omits .phar. This handler likely processes file chunks via an AJAX action (e.g., `gravityforms_chunked_upload`) without authentication checks, and assembles the final file based on the provided filename. The description confirms the blacklist omission, but specific code details (e.g., the exact AJAX action name, chunk parameters, and file path construction) are inferred from WordPress plugin conventions and the vulnerability description.
Exploitation: An attacker sends multiple POST requests to `/wp-admin/admin-ajax.php` with the action parameter set to the chunked upload handler (likely `gravityforms_chunked_upload`). Each request includes a chunk of the malicious .phar file, along with parameters such as `chunk`, `chunks`, and `filename` (set to a .phar extension). The handler saves chunks to a temporary directory and assembles the final file, which is then moved to a predictable upload path (e.g., `/wp-content/uploads/gravity_forms/`). The attacker must discover or enumerate the final upload path to access and execute the .phar file. This exploitation requires the web server to be configured to process .phar files as PHP, which is not default but may be enabled in some environments.
Remediation: The patch in version 2.9.22 likely adds .phar (and possibly other executable extensions) to the blacklist or switches to a whitelist approach for allowed file types. Atomic Edge analysis infers that the fix also strengthens authentication and nonce checks on the chunked upload handler. Administrators should upgrade to 2.9.22 or later. If upgrading is not possible, virtual patching via WAF rules that block .phar upload attempts to the chunked upload endpoint is recommended.
Impact: Successful exploitation allows an unauthenticated attacker to upload and execute arbitrary PHP code, leading to full remote code execution. This can result in complete compromise of the WordPress site, including data theft, backdoor installation, and lateral movement to other systems. The high CVSS impact metrics reflect the severity of potential confidentiality, integrity, and availability losses.
