Cyber & AI intelligence
Wasteland.
Briefs indexed2691
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-87796 2026-09-17

CVE-2026-87796: Unauthenticated Arbitrary File Upload in Multi Uploader for Gravity Forms

"A critical flaw in the Multi Uploader for Gravity Forms WordPress plugin (versions up to and including 1.1.9) lets unauthenticated attackers upload arbitrary files to the server, potentially leading to remote code…"

A critical flaw in the Multi Uploader for Gravity Forms WordPress plugin (versions up to and including 1.1.9) lets unauthenticated attackers upload arbitrary files to the server, potentially leading to remote code execution.

What Is It

CVE-2026-87796 is an arbitrary file upload vulnerability (CWE-434) in the move_file function of the Multi Uploader for Gravity Forms plugin by sh1zen. The plugin performs insufficient file type validation while handling chunked uploads, so an attacker can push files of arbitrary type onto the target site's filesystem. Because the upload path is reachable without authentication, exploitation requires no account, no privileges, and no user interaction.

Wordfence assigned the issue a CVSS 3.1 base score of 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, full confidentiality, integrity, and availability impact over the network at low attack complexity.

Why It Matters

Unauthenticated file upload on a WordPress site is effectively a path to server-side code execution. If an attacker can drop a PHP file into a web-accessible directory, they inherit the privileges of the web server: database access, content modification, persistence via webshells, and use of the host as a pivot or staging point.

The exploitability subscore is the maximum possible (3.9), which reflects how little an attacker needs to bring to the table. Public plugin source is referenced in the advisory, including the specific vulnerable lines, which lowers the research cost for anyone building an exploit.

There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time.

What's Vulnerable

Patch Status

The supplied NVD record (published 2026-09-17, status "Received") does not list a fixed version or a vendor patch reference, and no CISA-mandated remediation deadline exists because the CVE is not in KEV. Until a fixed release is confirmed, operators running 1.1.9 or earlier should treat the plugin as exposed.

Sources