Unauthenticated Arbitrary Media Deletion in Multi Uploader for Gravity Forms

The Multi Uploader for Gravity Forms plugin for WordPress (versions 1.1.8 and below) contains a critical vulnerability (CVE-2026-5581) that allows unauthenticated attackers to delete any file from the WordPress media library. The flaw exists within the plupload_ajax_delete_file() function, which is improperly registered with the wp_ajax_nopriv_gfmu_delete_file hook. Furthermore, the security nonce intended to prevent Cross-Site Request Forgery (CSRF) is inadvertently exposed within the GFMU_options JavaScript object on any public-facing page containing a multi-uploader form. Because the function lacks adequate capability checks, an unauthenticated attacker can discover the valid nonce and craft an AJAX request to delete arbitrary attachments by their ID. This vulnerability poses a high risk to WordPress site integrity, as it enables the mass destruction of media assets.

Attack Chain

1. Attacker browses public-facing pages on the target WordPress site to identify presence of the plugin.
2. Attacker inspects page source or JavaScript execution context to extract the GFMU_options object.
3. Attacker parses the JavaScript object to obtain the active CSRF nonce value.
4. Attacker identifies target attachment IDs (e.g., via brute force or sequential estimation if ID enumeration is possible).
5. Attacker crafts an HTTP POST request targeting the /wp-admin/admin-ajax.php endpoint.
6. Attacker includes the action parameter set to gfmu_delete_file and provides the valid nonce and target attachment ID.
7. The vulnerable plugin function plupload_ajax_delete_file() executes the deletion without verifying the user's administrative privileges.
8. The specified media file is permanently removed from the WordPress media library and storage.

Impact

Successful exploitation results in the permanent loss of media library assets. This can disrupt website operations, destroy historical content, and force administrators to rely on backups for restoration. The vulnerability is highly accessible as it does not require prior authentication or elevated permissions.

Recommendation

Prioritize the following actions to mitigate this vulnerability:

• Update the "Multi Uploader for Gravity Forms" plugin to the latest version immediately.
• Implement Web Application Firewall (WAF) rules to restrict access to the /wp-admin/admin-ajax.php endpoint for actions related to file deletion from unauthenticated sessions.
• Monitor web server logs for suspicious POST requests to admin-ajax.php involving the gfmu_delete_file action, especially those lacking associated administrative cookies.