← Back to the live CVE advisory feed

CVE-2026-87796: Multi Uploader for Gravity Forms

Severity

9.8 (CRITICAL)

Vendor

SH1ZEN

Affected versions

All versions up to, and including, 1.1.9

Fixed version

unknown

Patch status

Unpatched

Published

2026-09-17T05:17:02.123

Modified

2026-09-17T05:17:02.123

Why it matters

This vulnerability allows unauthenticated attackers to upload arbitrary files to the server via the Multi Uploader for Gravity Forms plugin. This bypasses security measures, potentially enabling remote code execution and full compromise of the WordPress site. Such a compromise can lead to data theft

Recommended admin actions

• Immediately identify all WordPress sites using the Multi Uploader for Gravity Forms plugin.
• Disable or remove the Multi Uploader for Gravity Forms plugin from affected sites until a patched version is available.
• Monitor web server and WordPress application logs for suspicious file uploads or activity.
• Consider implementing Web Application Firewall (WAF) rules to block suspicious file uploads to known vulnerable paths.
• Evaluate alternative solutions for file uploading if the plugin's functionality is critical.

Technical summary

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

View the official NVD record for CVE-2026-87796

AI-enriched (HIGH confidence). Validate against the vendor advisory before taking production action.