CVE-2014-4972

CRITICAL

Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.

Published: Jan 8, 2018 Modified: Jun 17, 2026

CWE-434

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (1)

Vendor	Product	Version
ajax_upload_for_gravity_forms_project	ajax_upload_for_gravity_forms	*

GitHub Security Advisory GHSA-j9qg-6qfp-wh76

Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for...

References (4)

https://g0blin.co.uk/cve-2014-4972/ Exploit, Third Party Advisory
https://wpvulndb.com/vulnerabilities/8232 Third Party Advisory
https://g0blin.co.uk/cve-2014-4972/ Exploit, Third Party Advisory
https://wpvulndb.com/vulnerabilities/8232 Third Party Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 4.65%

Top 9% most likely to be exploited

Threat Score 40.6 / 100

Data Sources

NVD EPSS GitHub