CVE-2026-87796criticalCWE-434

CVE-2026-87796: critical vulnerability in sh1zen Multi Uploader for Gravity Forms

Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

Published · Updated

Follow this CVE+ Monitor Multi Uploader for Gravity Forms

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 1.1%
from disclosure to weaponsame day
Published on NVDSep 17
1st PoCSep 17
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
sh1zen · Multi Uploader for Gravity Forms
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — sh1zen Multi Uploader for Gravity Forms

In the same product, most dangerous first.

CVE-2026-5581CRITICALMulti Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media DeletionEPSS 0.7%CVE-2025-23921CRITICALWordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2025-14344CRITICALMulti Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File DeletionEPSS 0.5%