A missing capability check in the WordPress plugin "Multi Uploader for Gravity Forms" lets unauthenticated attackers permanently delete any media attachment on the site, scoring CVSS 9.1 (Critical).
What Is It
CVE-2026-5581 is an unauthorized arbitrary media deletion flaw (CWE-862, Missing Authorization) in the Multi Uploader for Gravity Forms plugin by sh1zen. The plupload_ajax_delete_file() function is registered via the wp_ajax_nopriv_gfmu_delete_file hook, meaning it is reachable by unauthenticated visitors, and it lacks capability checks.
The nonce meant to serve as CSRF protection provides no real barrier: it is exposed on any public-facing page containing a multi-uploader form field, via the GFMU_options JavaScript object. An attacker simply reads the nonce off the page and then supplies an arbitrary attachment ID to delete that media item.
Why It Matters
CVSS 3.1 base score is 9.1 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Network attack vector, low complexity, no privileges, no user interaction; with High impact to both integrity and availability. Confidentiality impact is None; this is a destructive bug, not a data-theft bug.
Because the attachment ID is attacker-supplied and unconstrained, an attacker who enumerates attachment IDs could plausibly destroy the entire media library. Any site running the affected plugin with a public-facing uploader form appears to be directly reachable.
Exploitation status for this CVE is unverified. Defenders should check the CISA Known Exploited Vulnerabilities catalog and vendor telemetry directly rather than treating the vulnerability as unexploited by default; the CVSS profile and trivial exploitation path warrant prompt action regardless of confirmed in-the-wild activity.
What's Vulnerable
- Vendor: sh1zen
- Product: Multi Uploader for Gravity Forms (WordPress plugin)
- Affected versions: all versions up to and including 1.1.8
- Default status for other versions is listed as unaffected.
No CPE entries were published in the NVD record at time of writing.
Patch Status
The NVD record (published 2026-08-05, status: Received) does not state a fixed version. A plugin trac changeset is referenced comparing revision 3421317 to 3501985 on trunk, which indicates code changes upstream; administrators should review that changeset and the plugin's current release, and in the interim disable or remove the plugin on any site exposing a multi-uploader form field.
Sources
- NVD, CVE-2026-5581: https://nvd.nist.gov/vuln/detail/CVE-2026-5581
- Wordfence Threat Intel: https://www.wordfence.com/threat-intel/vulnerabilities/id/16dca898-1a98-4e0b-8f48-dc01ba2dc4e6?source=cve
- Plugin source (GFMUAddon.class.php, v1.1.8): https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.8/GFMUAddon.class.php#L131
- Plugin source (GFMUHandlePluploader.class.php, v1.1.8): https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.8/inc/GFMUHandlePluploader.class.php#L66
- Trac changeset (3421317 → 3501985): https://plugins.trac.wordpress.org/changeset?new=3501985%40gf-multi-uploader%2Ftrunk&old=3421317%40gf-multi-uploader%2Ftrunk