Multi Uploader for Gravity Forms
Multi Uploader for Gravity Forms has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 3 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 9.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 4 critical and 0 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 2 of the records (50%). Other recurring categories include Missing Authorization, Path Traversal.
3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.
4 independent researchers contributed these findings, one record each. Multi Uploader for Gravity Forms is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-87796Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload
Read the full analysisVulnerability Records

Multi Uploader for Gravity Forms
Author
sh1zen
This is an advanced upload plugin for those who need a little more than the default multi file upload of Gravity Forms. The plugin options page provides you with granular control over many Plupload parameters from file extension filters to chunked uploading and runtimes. All files are uploaded to the WordPress media library on successful form submission making for easy access and management. Chunk buffers are stored in PHP’s system temporary directory and require it to be writable and outside the WordPress document root. Files uploaded before this security update must be uploaded again if their forms have not yet been submitted. Temporary staging is limited to 200 pending files and a size budget based on the configured maximum upload size. Private chunk buffers have the same size budget and a limit of 200 active uploads. FEATURES Safety: validation of both file extension and mime type. Privacy: filenames changed once added to media library. Advanced Customization: many options and many hooks to modify any plugin rule. Large File Support: enabled by chunked file uploads. Media library integration: all files are uploaded to the WordPress media library on successful form submission making for easy access and management. Entry list creation integration: A list of all correctly uploaded files, with relative link. DONATIONS This plugin is free and always will be, but if you are feeling generous and want to show your support, you can buy me a beer or coffee here, I will really appreciate it. Hooks Filters: * ‘gfmu_before_attach_uploads’ * ‘gfmu_maybe_insert_attachment’ * ‘gfmu_server_validation_args’ * ‘gfmu_insert_attachment_args’ * ‘gfmu_field_options’ * ‘gfmu_save_entry’
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C