Aviary Image Editor - RCE (CVE-2015-4455)
Description
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
psychologyCrowdSec Analysis
CVE-2015-4455 is a critical vulnerability in the Aviary Image Editor Add-on for Gravity Forms on WordPress, enabling attackers to upload files with executable extensions and achieve remote code execution.
CrowdSec has been tracking this vulnerability and its exploits since 3rd of April 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2015-4455 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2015-4455 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2015-4455 is currently experiencing high visibility and active exploitation across the internet.
Attacks are characterized by requests to URLs that include /?gf_page=upload.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2017-05-23 |
| Rule Released | 2025-04-03 |
| CrowdSec First Seen | 2025-04-07 |