Security Alert Summary
The Multi Uploader for Gravity Forms plugin for WordPress contains an arbitrary file upload vulnerability in all versions up to and including 1.1.9. The issue stems from insufficient file type validation during chunked upload handling, allowing unauthenticated attackers to upload arbitrary files via the plugin’s upload code. Uploaded files on the server may, in some cases, enable further attacks including potential remote code execution.
CVE Details
- CVE ID: CVE-2026-87796
- Affected component: Multi Uploader for Gravity Forms plugin for WordPress
- Affected versions: All versions up to and including 1.1.9
- Published: September 17, 2026 at 05:17:02 AM UTC
- Last modified: September 17, 2026 at 05:17:02 AM UTC
- CVSS v3.1:
- Base score: 9.8
- Severity: CRITICAL
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Attack vector: NETWORK
- Attack complexity: LOW
- Privileges required: NONE
- User interaction: NONE
- Scope: UNCHANGED
- Primary impact: High impact to Confidentiality, Integrity, and Availability
- Weakness: CWE-434 (Unrestricted Upload of File with Dangerous Type)
Technical Details
The vulnerability is an arbitrary file upload flaw caused by insufficient validation of file types during chunked upload handling in the plugin. The plugin’s upload flow accepts chunks and assembles them into files without adequate checks to ensure the final file is an allowed type. The issue is associated with the plugin’s move_file behavior during the chunked upload process.
References in the codebase point to upload-related classes and files, including GFMUAddon.class.php, GFMUHandlePluploader.class.php, and GFMU_FileUploader.php. These files contain the upload handling logic and the locations cited in the advisory. The lack of sufficient file type validation during the chunk assembly and move operation is the root cause described in the advisory.
Impact: an unauthenticated attacker can upload arbitrary files to the affected site. Uploaded files placed in web-accessible locations can be used to store sensitive data, disrupt site integrity, or, in some hosting configurations, enable execution of attacker-supplied code. The advisory notes that remote code execution may be possible, depending on the server environment and file placement.
How This Could Impact Your Website
Consider a typical small site workflow: the site owner installs the Multi Uploader for Gravity Forms plugin to simplify file submissions from external contributors. Internal staff and external contractors upload files through forms. Because the vulnerability allows unauthenticated arbitrary file uploads, an attacker could upload files that expose internal directory listings or stored data, or place files in locations that could be accessed by other users or the public web.
Practical consequences include exposure of internal user email addresses or uploaded documents if attackers gain access to stored files, and an increased risk of targeted phishing or social engineering campaigns using data harvested from uploaded content or accessible files. Depending on hosting and file placement, uploaded files could also be used to tamper with site content or availability.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can interact with file upload forms.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Harden file upload handling where possible: restrict upload locations, enforce server-side file type checks, and block execution in upload directories.
- Monitor site activity and logs for unusual file uploads or requests to newly added files.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/GFMUAddon.class.php#L125
- https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMUHandlePluploader.class.php#L257
- https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L319
- https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L322
- https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L560
- https://www.wordfence.com/threat-intel/vulnerabilities/id/47337bc1-fa3d-470c-9524-859295261017?source=cve
