Description

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-17T05:17:02.123Z",
  "pubdate": "2026-09-17T05:17:02.123Z",
  "executiveSummary": "The Multi Uploader for Gravity Forms plugin for WordPress, in versions up to and including 1.1.9, contains a critical arbitrary file upload vulnerability. This vulnerability stems from insufficient file type validation within the plugin's chunked upload handling mechanism, specifically located in the move_file function.\nThe flaw allows unauthenticated remote attackers to bypass security restrictions and upload arbitrary files directly to the web server's filesystem. This capability introduces a significant risk to site integrity and confidentiality, as it facilitates Remote Code Execution (RCE) if an attacker uploads malicious executable scripts, such as PHP shells.\nBecause the attack requires no authentication and can be performed remotely, the vulnerability carries a high-risk profile. Successful exploitation allows for complete server compromise, including unauthorized access to sensitive data, site defacement, and the potential for establishing persistent backdoors within the WordPress environment. Administrators of the affected plugin should prioritize remediation efforts immediately.",
  "technicalDetails": "The vulnerability is rooted in the insecure implementation of the move_file function within the Multi Uploader for Gravity Forms plugin. The function is designed to handle chunked file uploads, a process intended to facilitate the transfer of large files by breaking them into smaller segments that are later reassembled on the server.\nThe root cause is a lack of robust input sanitization and MIME-type verification during the file reassembly or storage process. When a user submits a file upload request, the plugin fails to properly validate the file extension or the content of the uploaded payload against a secure whitelist of allowed file types. Consequently, the application blindly accepts and saves the uploaded file to a location within the web server's public directory structure.\nThe exploitation flow is straightforward for an unauthenticated attacker. By sending specially crafted HTTP POST requests to the vulnerable endpoint, an attacker can manipulate the chunked upload parameters. By supplying a file with a malicious extension—such as .php—the attacker circumvents the intended security controls. Since the move_file function does not enforce strict validation, it moves the uploaded content into the filesystem with its original, malicious extension preserved.\nThe attack vector is network-based and requires no prior access or credentials to the target system. Upon successfully uploading a PHP script, the attacker can then trigger the execution of that script by navigating to its URI via a standard web browser. This results in the server executing the attacker-supplied code with the privileges of the web server user (e.g., www-data).\nPost-exploitation impact is severe. Once RCE is achieved, an attacker can execute arbitrary system commands, read sensitive configuration files (such as wp-config.php), access the WordPress database to extract user credentials, or pivot deeper into the underlying server infrastructure. The persistence of such an attack is limited only by the attacker's ability to maintain access, making this a critical threat to the overall security posture of the WordPress installation."
}