Multi Uploader for Gravity Forms

Multi Uploader for Gravity Forms 1.1.9 and earlier is vulnerable to an unauthenticated arbitrary file upload (CVE-2026-87796). Wordfence rates the issue Critical at CVSS 9.8. As of this advisory, Wordfence lists no patched release, and the WordPress.org plugin page says the plugin has been closed to new downloads pending review.

Vulnerability summary

How the flaw can affect a site

According to Wordfence Intelligence, the plugin’s move_file function does not adequately validate file types when it completes a chunked upload. An unauthenticated attacker may be able to assemble and move a file of an unintended type onto the server. If the resulting file can be executed by the web server, arbitrary file upload may become remote code execution.

The risk is conditional on how the site exposes the uploader and how its web server handles files in the destination directory. The vulnerability record does not establish that every affected site has already been compromised. It does establish that relying on client-supplied extensions or MIME labels is insufficient protection for this upload path.

Immediate mitigation while no patch is available

1. Deactivate the plugin immediately if it is installed. Remove it after confirming that form submissions and stored uploads are backed up and that replacement upload functionality is ready.
2. Do not re-enable the plugin based only on a WAF rule. Wait for a vendor-fixed release whose changelog or security record explicitly addresses CVE-2026-87796, or replace the plugin.
3. Review the site’s uploads and temporary chunk directories for unexpected executable files. Preserve suspicious files and logs for incident response before removing them.
4. Review web access logs for unusual upload activity and later requests to recently created files. Inspect administrator accounts, scheduled tasks, and integrity of WordPress core and plugins if there are signs of compromise.
5. Configure the web server to refuse execution of PHP-family files in upload locations. This is defense in depth and not a substitute for removing the vulnerable code.

Safe verification commands

Identify whether the affected plugin is present and stop it while you investigate:

wp plugin get gf-multi-uploader --fields=name,status,version --format=table
wp plugin deactivate gf-multi-uploader

List recent PHP-family files in the standard uploads tree. Adjust the directory if your site uses a custom upload path:

find wp-content/uploads -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' \) -mtime -30 -print

The absence of matching filenames does not prove a site is clean: attackers may use other locations, filenames, or persistence methods. If you find an executable upload or unauthorized administrator account, isolate the site, preserve evidence, rotate credentials, and restore from a trusted backup after addressing the entry point.

Temporary server hardening

On Apache installations that honor per-directory .htaccess files, a rule inside wp-content/uploads can deny direct HTTP access to PHP-family files. Test on staging and use the equivalent server-level rule on nginx or LiteSpeed. This rule is only a temporary additional control.

<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

Related history

Wordfence’s record lists earlier serious issues in this same plugin, including unauthenticated media deletion and file deletion. Those are separate disclosures; do not assume an old fix addresses this newly disclosed chunked-upload vulnerability.

Sources

• Wordfence Intelligence: CVE-2026-87796
• WordPress.org plugin page and closure notice

The discovery and CVSS assessment are attributed to Wordfence’s vulnerability record and its credited researcher, Adam Rayyan Aryasatya. WPDeeply is providing remediation guidance, not claiming original discovery.