Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
critical
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce inten...
- CVSS:
- 9.1
- Affected:
- up to 1.1.8
- Fixed in:
- 1.1.9
- Disclosed:
- Aug 4, 2026
CVE-2026-5581 on NVD →
Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion
critical
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_ajax_delete_file' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the serve...
- CVSS:
- 9.8
- Affected:
- up to 1.1.7
- Fixed in:
- 1.1.8
- Disclosed:
- Dec 11, 2025
CVE-2025-14344 on NVD →
Multi Uploader for Gravity Forms <= 1.1.3 - Unauthenticated Arbitrary File Upload
critical
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execu...
- CVSS:
- 9.8
- Affected:
- up to 1.1.3
- Fixed in:
- 1.1.5
- Disclosed:
- Jan 16, 2025
CVE-2025-23921 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database