Multi Uploader for Gravity Forms WordPress Plugin Vulnerability Alert
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- multi uploader for gravity forms (wordpress)
- Patched version
- Not yet available
The Multi Uploader for Gravity Forms WordPress plugin is reportedly vulnerable to Arbitrary File Upload in all versions up to and including 1.1.9.
What happened
The vulnerability, tracked as CVE-2026-87796, is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The plugin is under investigation for a supply-chain attack but there is no confirmed exploit in the wild as of now.
The vulnerability was first flagged on 2026-09-17T05:17:02.123000+00:00. The CVSS score is 9.8 indicating a critical severity. Users of the plugin should assess their exposure by checking the installed version against the affected range.
What to do about it
- Upgrade the Multi Uploader for Gravity Forms plugin to a version beyond 1.1.9 if available.
- If no update is available, remove the plugin from your WordPress site.
- Monitor the primary sources for updates on the vulnerability and any official fixes.
How 0Day would have caught this
multi uploader for gravity forms is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using the Multi Uploader for Gravity Forms plugin version 1.1.9 or earlier.
What should I do right now?
Upgrade to a version beyond 1.1.9 or remove the plugin if no update is available.
Is there an official fix available?
No official fix has been published yet. Monitor the sources for updates.