Cyber Resilience

CVE-2025-23921

Critical

Published: 22 January 2025

Published
22 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0032 55.9th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23921 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-23921 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the sh1zen Multi Uploader for Gravity Forms plugin (gf-multi-uploader) for WordPress. Published on 2025-01-22, it affects all versions up to and including 1.1.3 and enables attackers to upload a web shell to the web server. The vulnerability carries a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact confidentiality, integrity, and availability effects across a changed scope.

Remote attackers require no privileges or user interaction but must overcome high attack complexity to exploit this over the network. Successful exploitation allows uploading malicious files, such as web shells, granting attackers remote code execution on the server and potentially full compromise of the affected WordPress site.

Patchstack advisories provide details on this arbitrary file upload vulnerability in Multi Uploader for Gravity Forms version 1.1.3; security practitioners should review https://patchstack.com/database/Wordpress/Plugin/gf-multi-uploader/vulnerability/wordpress-multi-uploader-for-gravity-forms-plugin-1-1-3-arbitrary-file-upload-vulnerability?_s_id=cve for mitigation recommendations, including patching to a fixed version if available.

EU & UK References

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web Server.This issue affects Multi Uploader for Gravity Forms: from n/a through <= 1.1.3.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Unrestricted file upload in public-facing WordPress plugin directly enables exploitation of public-facing apps (T1190) and web shell deployment (T1100) for RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-46384Shared CWE-434
CVE-2025-13516Shared CWE-434
CVE-2024-13011Shared CWE-434
CVE-2025-8323Shared CWE-434
CVE-2025-21624Shared CWE-434
CVE-2026-35164Shared CWE-434
CVE-2026-2097Shared CWE-434
CVE-2025-12154Shared CWE-434
CVE-2026-42748Shared CWE-434
CVE-2025-32957Shared CWE-434

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the unrestricted file upload vulnerability in the gf-multi-uploader plugin by identifying, prioritizing, and correcting the flaw through patching or removal.

SI-10 Information Input Validation good match
prevent

Enforces validation of file uploads to block dangerous types like web shells, directly countering the CWE-434 unrestricted upload exploited in this CVE.

SI-3 Malicious Code Protection good match
preventdetect

Scans uploaded files in real-time and periodically for malicious code such as web shells enabled by this arbitrary file upload vulnerability.

References