# CVE-2015-4455: Aviary Image Editor - RCE

> Live exploitation tracking for CVE-2015-4455 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2015-4455

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** N/A Aviary Image Editor
- **Weaknesses:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
- **Tags:** cms, wordpress

## Description

Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.

## CrowdSec analysis

[CVE-2015-4455](https://euvd.enisa.europa.eu/vulnerability/CVE-2015-4455) is a critical vulnerability in the Aviary Image Editor Add-on for Gravity Forms on WordPress, enabling attackers to upload files with executable extensions and achieve remote code execution.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of April 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2015-4455 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2015-4455 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2015-4455 is currently experiencing high visibility and active exploitation across the internet.

Attacks are characterized by requests to URLs that include `/?gf_page=upload`.

## Timeline

- 2017-05-23: CVE Published. CVE-2015-4455 is published to NVD.
- 2025-04-03: Rule Released. CrowdSec releases a rule to detect CVE-2015-4455 exploitation attempts against the CrowdSec Network.
- 2025-04-07: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2015-4455 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4455.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2015-4455) follows observed exploitation activity for CVE-2015-4455. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.