Multi Uploader for Gravity Forms
Multi Uploader for Gravity Forms (gf-multi-uploader) is a WordPress plugin with 3 published CVE records in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 9.8.
gf-multi-uploaderCVE-2026-5581: Multi Uploader unauthenticated attachment deletion can destroy the media library
Multi Uploader for Gravity Forms through 1.1.8 registers wp_ajax_nopriv_gfmu_delete_file for logged-out visitors. Any public page containing a multi-uploader field exposes the required nonce in the GFMU_options JavaScript object, and plupload_ajax_delete_file() does not perform a capability check before acting on an attacker-supplied attachment ID. An unauthenticated attacker can therefore permanently delete arbitrary WordPress media attachments and potentially destroy the entire media library. The CNA does not disclose the attachment-ID or nonce parameter names or the final deletion function.
| Safe version |
|
||
|---|---|---|---|
| Aug 05, 2026 |
CVE-2026-5581
Multi Uploader unauthenticated attachment deletion can destroy the media library
Multi Uploader for Gravity Forms through 1.1.8 registers wp_ajax_nopriv_gfmu_delete_file for logged-out visitors. Any public page containing a multi-uploader field exposes the required nonce in the GFMU_options JavaScript object, and plupload_ajax_delete_file() does not perform a capability check before acting on an attacker-supplied attachment ID. An unauthenticated attacker can therefore permanently delete arbitrary WordPress media attachments and potentially destroy the entire media library. The CNA does not disclose the attachment-ID or nonce parameter names or the final deletion function.
|
> 1.1.8 |
CVE9.1
NVDPending
|
| Dec 12, 2025 |
CVE-2025-14344
Multi Uploader for Gravity Forms: Arbitrary file deletion
Multi Uploader for Gravity Forms is affected by arbitrary file deletion. The vulnerable path is reachable without authentication. A successful request can remove files outside the intended scope and may make the site unavailable. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE9.8
NVDPending
|
| Jan 22, 2025 |
CVE-2025-23921
Multi Uploader for Gravity Forms: Dangerous file upload
Multi Uploader for Gravity Forms is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE9.0
NVDPending
|