Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-87796

Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

CVSS 3.1 9.8 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-87796

Published

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-87796

Published

Multi Uploader for Gravity Forms

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "sh1zen",
                    "product": "Multi Uploader for Gravity Forms",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "1.1.9",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON