Critical RCE in the “Multi Uploader for Gravity Forms” Plugin (CVE-2026-87796) Update or Remove It Now

TL;DR: A critical (CVSS 9.8) vulnerability in the Multi Uploader for Gravity Forms WordPress plugin lets unauthenticated attackers upload malicious files and run code on your server. Every version up to and including 1.1.9 is affected. Update to 1.2.0 immediately — or deactivate and delete the plugin if you can’t. A public proof-of-concept now exists, so treat this as urgent.

What happened

CVE-2026-87796 was published on September 17, 2026, and carries a CVSS 3.1 base score of 9.8 — critical. The vulnerability is an unauthenticated arbitrary file upload in the plugin’s move_file function, caused by insufficient file-type validation during chunked upload handling. In short: the plugin reassembles uploaded file chunks and writes them to disk without properly enforcing an allow-list of permitted file types or extensions, and the upload endpoint has no authentication or capability checks guarding it.

Because that endpoint accepts input from unauthenticated requests, an attacker can submit a crafted upload — for example, a PHP payload disguised with an image header and split across chunks — and have the server reassemble and store it with an attacker-chosen extension. Once a .php file lands in a web-accessible path, simply requesting it in a browser executes it in the context of the web server. That turns a file-upload bug into full remote code execution, opening the door to web shells, credential theft from wp-config.php, and lateral movement.

Why this one is urgent

• No authentication, no user interaction, remote over the network — the easiest possible attack conditions.
• A public proof-of-concept is now circulating, demonstrating the upload-and-execute chain against a test target. Public PoCs typically shorten the runway before opportunistic scanning and mass exploitation begin, even though this CVE is not yet listed as known-exploited in the wild.
• Unlike some related Gravity Forms upload flaws that depend on specific server configurations, this one writes into standard WordPress upload paths, so a wide range of setups are exposed.

This plugin also has prior history of upload-related fixes (an arbitrary file upload patched in 1.1.5 and an arbitrary file deletion patched in a later 1.1.x release), which is a reminder that file-handling add-ons deserve extra scrutiny.

Who is affected

Any WordPress site running Multi Uploader for Gravity Forms version 1.1.9 or earlier, particularly where the plugin’s chunked upload endpoint is reachable by unauthenticated visitors.

What you should do

1. Update to version 1.2.0 or later. The fix strengthens the file-type validation that was missing. This is the single most important step.
2. If you can’t update right away, deactivate and delete the plugin to remove the attack surface entirely until you can patch.
3. Audit wp-content/uploads/ for unauthorized files — especially anything with .php, .phtml, or .phar extensions, and check the plugin’s temporary upload directory (gfmu-uploads-tmp) for suspicious artifacts.
4. Disable PHP execution in your uploads directory as a defense-in-depth measure (see config below).
5. If you suspect compromise, rotate credentials — WordPress admin passwords, database credentials, and any API keys stored in wp-config.php — and consider a full malware scan or professional incident review.

Hardening: block script execution in uploads

Even after patching, preventing PHP from executing inside your uploads directory is a good permanent safeguard:

apache

# Apache — place in wp-content/uploads/.htaccess
<Files *.php>
    Require all denied
</Files>

nginx

# Nginx — add inside the server block
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

What to watch for

Signs worth investigating in your logs include unauthenticated POST requests to the gf-multi-uploader upload endpoint (via admin-ajax.php), new executable files appearing in your uploads folders, direct GET requests to those files, and unexpected outbound network connections from your web server process after upload activity.

The bottom line

CVE-2026-87796 is a textbook unauthenticated-upload-to-RCE flaw in a plugin that many site owners may not even remember installing. With a patch available and a proof-of-concept already public, the window to act is now: update to 1.2.0, or pull the plugin, and lock down script execution in your uploads directory as a standing precaution.