CVE-2026-87796CWE-434unrestricted-file-upload

CVE-2026-87796

Critical · published September 17, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
66.4
In the wild
Unconfirmed
What it is

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01141 · 66.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-09-17T09:17Z
References (6)
https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/GFMUAddon.class.php#L125 · [email protected]https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMUHandlePluploader.class.php#L257 · [email protected]https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L319 · [email protected]https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L322 · [email protected]https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L560 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/47337bc1-fa3d-470c-9524-859295261017?source=cve · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 1%
    epss
  • 17 SEP 04:28Z
    Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload
    cvelistv5