CVE-2026-87796criticalCWE-434

CVE-2026-87796: falha crítica em sh1zen Multi Uploader for Gravity Forms

Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Multi Uploader for Gravity Forms

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 9.8epss 1.1%
da publicação à armano mesmo dia
Publicada no NVD17 de set.
1ª PoC17 de set.
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
sh1zen · Multi Uploader for Gravity Forms
PoCs públicas encontradas — 1
githubgithub.com/abraxas/CVE-2026-87796★ 1
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — sh1zen Multi Uploader for Gravity Forms

No mesmo produto, das mais perigosas para as menos.

CVE-2026-5581CRITICALMulti Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media DeletionEPSS 0.7%CVE-2025-23921CRITICALWordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2025-14344CRITICALMulti Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File DeletionEPSS 0.5%