WordPress security changelog
CRITICAL CVE-2026-5581 Deferred

Multi Uploader unauthenticated attachment deletion can destroy the media library

Multi Uploader for Gravity Forms through 1.1.8 registers wp_ajax_nopriv_gfmu_delete_file for logged-out visitors. Any public page containing a multi-uploader field exposes the required nonce in the GFMU_options JavaScript object, and plupload_ajax_delete_file() does not perform a capability check before acting on an attacker-supplied attachment ID. An unauthenticated attacker can therefore permanently delete arbitrary WordPress media attachments and potentially destroy the entire media library. The CNA does not disclose the attachment-ID or nonce parameter names or the final deletion function.

CVE / CNA score 9.1 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Multi Uploader for Gravity Forms
Plugin slug
gf-multi-uploader
Affected
<= 1.1.8
Safe version
> 1.1.8
Published
Aug 05, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Aug 05, 2026 and is one of 3 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Multi Uploader for Gravity Forms to a release after 1.1.8. The authoritative record links a trunk correction but does not identify the first fixed release. Review missing media, restore deleted attachments from a known-good backup and investigate requests to gfmu_delete_file if a vulnerable version was public.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-uploader form field via the `GFMU_options` JavaScript object. This makes it possible for unauthenticated attackers to permanently delete any WordPress media attachment by supplying its attachment ID, potentially leading to complete media library destruction.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

Primary and upstream sources