CVE-2026-87796

The Multi Uploader for Gravity Forms WordPress plugin is vulnerable to unauthenticated arbitrary file upload (CWE-434) in all versions up to and including 1.1.9, caused by insufficient file type validation in the move_file function during chunked upload handling. An attacker with no account or privileges can send crafted chunked upload requests to the plugin's endpoint and place arbitrary files, such as malicious PHP scripts, on the affected server. Successfully uploaded web-executable files may enable complete remote code execution, giving the attacker full control of the site and its data. Any WordPress site running the plugin at version 1.1.9 or older is affected, and the vulnerability is rated critical (CVSS 9.8). As of this analysis there is no evidence of in-the-wild exploitation and no known public proof-of-concept.

What to do: Update Multi Uploader for Gravity Forms to the first patched release after 1.1.9 as soon as one is available; if no patch is published yet, deactivate or remove the plugin until a fixed version ships. Check the wp-content uploads directory for unexpected PHP or other executable files and review web-server logs for unauthenticated POST requests to the plugin's upload endpoints. Given the unauthenticated RCE potential, treat any site running version 1.1.9 or older as at risk and verify integrity of the WordPress installation if compromise is suspected.