CVE-2026-87796 - Arbitrary File Upload in Multi Uploader for Gravity Forms

The Multi Uploader for Gravity Forms plugin for WordPress (versions up to and including 1.1.9) contains a critical vulnerability (CVE-2026-87796) in its chunked upload handling logic. The vulnerability resides in the move_file function, which fails to adequately validate the type of files being processed during the upload sequence.

This flaw allows an unauthenticated remote attacker to bypass intended file type restrictions and upload arbitrary files, such as malicious PHP scripts, to the web server directory. By successfully uploading a web shell, an attacker can achieve remote code execution, leading to full site compromise. Defenders should prioritize patching or disabling the plugin until an update is applied, as this vulnerability provides a direct pathway for unauthenticated attackers to gain persistent access to the server environment.

Impact

Successful exploitation of CVE-2026-87796 grants an unauthenticated attacker the ability to execute arbitrary code on the underlying web server. This can lead to total site takeover, data exfiltration, and the deployment of additional malicious payloads. All WordPress sites utilizing the Multi Uploader for Gravity Forms plugin version 1.1.9 or earlier are at risk.

Recommendation

• Immediately update the Multi Uploader for Gravity Forms plugin to the latest version once available to address the move_file function validation logic.
• If no patch is available, deactivate the plugin to mitigate the risk of arbitrary file upload.
• Monitor web server logs for suspicious POST requests targeting chunked upload endpoints.
• Implement file integrity monitoring (FIM) on the WordPress upload directories to detect unauthorized file creations or extensions (e.g., .php, .phtml).