Attack Chain

1. Attacker browses public-facing pages on the target WordPress site to identify presence of the plugin.
2. Attacker inspects page source or JavaScript execution context to extract the GFMU_options object.
3. Attacker parses the JavaScript object to obtain the active CSRF nonce value.
4. Attacker identifies target attachment IDs (e.g., via brute force or sequential estimation if ID enumeration is possible).
5. Attacker crafts an HTTP POST request targeting the /wp-admin/admin-ajax.php endpoint.
6. Attacker includes the action parameter set to gfmu_delete_file and provides the valid nonce and target attachment ID.
7. The vulnerable plugin function plupload_ajax_delete_file() executes the deletion without verifying the user's administrative privileges.
8. The specified media file is permanently removed from the WordPress media library and storage.

Impact

Successful exploitation results in the permanent loss of media library assets. This can disrupt website operations, destroy historical content, and force administrators to rely on backups for restoration. The vulnerability is highly accessible as it does not require prior authentication or elevated permissions.

Recommendation

Prioritize the following actions to mitigate this vulnerability:

• Update the "Multi Uploader for Gravity Forms" plugin to the latest version immediately.
• Implement Web Application Firewall (WAF) rules to restrict access to the /wp-admin/admin-ajax.php endpoint for actions related to file deletion from unauthenticated sessions.
• Monitor web server logs for suspicious POST requests to admin-ajax.php involving the gfmu_delete_file action, especially those lacking associated administrative cookies.