CVE-2014-6446: Infusionsoft Gravity Forms Project Infusionsoft Gravity Forms

High severity, CVSS 7.5. EPSS: 46.2% chance of exploitation in the next 30 days.

The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.

Affected products

• Infusionsoft Gravity Forms Project Infusionsoft Gravity Forms: version 1.5.3 only; version 1.5.4 only; version 1.5.4.1 only; version 1.5.4.2 only; version 1.5.5 only; version 1.5.6 only; …

Published 2014-09-26. Last modified 2026-06-17.