CVE-2026-5581: Gravity Forms Auth Bypass Vulnerability

CVE-2026-5581 Overview

CVE-2026-5581 is a missing authorization vulnerability [CWE-862] in the Multi Uploader for Gravity Forms plugin for WordPress. The flaw affects all versions up to and including 1.1.8. The plupload_ajax_delete_file() function is registered through the wp_ajax_nopriv_gfmu_delete_file action, exposing file deletion to unauthenticated requests. The nonce intended for cross-site request forgery (CSRF) protection is published in the GFMU_options JavaScript object on any public page that renders a multi-uploader form field. Unauthenticated attackers can retrieve the nonce and issue delete requests against arbitrary attachment IDs, wiping the WordPress media library.

Critical Impact
Unauthenticated attackers can permanently delete any WordPress media attachment, leading to complete media library destruction on affected sites.

Affected Products

Multi Uploader for Gravity Forms plugin for WordPress
All versions through 1.1.8
WordPress sites exposing the plugin's uploader form field on public pages

Discovery Timeline

2026-08-05 - CVE-2026-5581 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-5581

Vulnerability Analysis

The Multi Uploader for Gravity Forms plugin registers an AJAX handler for file deletion under the wp_ajax_nopriv_gfmu_delete_file hook. The nopriv variant of this hook makes the handler reachable by unauthenticated visitors. The underlying plupload_ajax_delete_file() function performs no capability check to confirm the caller is permitted to delete the requested attachment.

The function accepts an attachment ID supplied by the client and invokes WordPress media deletion primitives without validating ownership or role. Any integer that resolves to a valid attachment can be removed, including images, documents, and other files uploaded by administrators. The impact is deletion of arbitrary media across the entire library rather than deletion limited to files a user has uploaded.

The plugin does implement a nonce check, but the nonce is emitted into page HTML through the GFMU_options JavaScript object on any public page containing a multi-uploader form. An attacker requests such a page, parses the nonce from the response, and replays it against the AJAX endpoint.

Root Cause

The root cause is missing authorization [CWE-862] in plupload_ajax_delete_file(). The function lacks a current_user_can() verification, and its registration on the wp_ajax_nopriv_ hook permits anonymous invocation. The nonce provides no meaningful barrier because it is disclosed in public page source.

Attack Vector

Attack proceeds over the network without authentication or user interaction. The adversary fetches a page displaying the multi-uploader field, extracts the CSRF nonce from GFMU_options, and sends a POST request to admin-ajax.php with action=gfmu_delete_file, the nonce, and an attachment ID. Iterating attachment IDs from 1 upward enumerates and destroys the site's media library.

See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the vulnerable handler.

Detection Methods for CVE-2026-5581

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php carrying action=gfmu_delete_file from unauthenticated sessions
Sequential or high-volume attachment_id values submitted to the gfmu_delete_file action
Missing files in the wp-content/uploads/ directory that no longer resolve in the WordPress media library
Bulk attachment post deletions in the wp_posts table without a corresponding administrator session

Detection Strategies

Inspect web server access logs for admin-ajax.php calls with the gfmu_delete_file action originating from anonymous clients
Correlate WordPress audit logs against attachment deletion events not tied to an authenticated user ID
Alert on repeated GFMU_options fetches from a single source followed by admin-ajax.php POST bursts

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ to detect unexpected deletions
Forward WordPress and web server logs to a centralized platform for correlation and long-term retention
Track baseline media library counts and alert on rapid decreases

How to Mitigate CVE-2026-5581

Immediate Actions Required

Deactivate the Multi Uploader for Gravity Forms plugin until a fixed version is confirmed installed
Update to the patched release referenced in the WordPress Plugin Change Log
Verify recent backups of the WordPress media library and database are available for restoration
Audit the media library for unexpected deletions across the exposure window

Patch Information

A patched version has been published through the WordPress plugin repository. Review the WordPress Plugin Change Log and upgrade beyond version 1.1.8. Site operators should confirm the fix adds a capability check to plupload_ajax_delete_file() and restricts the handler from the wp_ajax_nopriv_ hook.

Workarounds

Remove multi-uploader form fields from public-facing pages to prevent nonce disclosure until the plugin is updated
Block unauthenticated POST requests to admin-ajax.php with action=gfmu_delete_file at the web application firewall (WAF)
Restrict access to pages containing Gravity Forms uploader fields to authenticated users where feasible

bash

# Example WAF rule to block unauthenticated gfmu_delete_file requests
# ModSecurity rule
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1026558101,\
    msg:'Block CVE-2026-5581 gfmu_delete_file exploitation'"
    SecRule ARGS:action "@streq gfmu_delete_file" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"