CVE-2026-87796: Multi Uploader for Gravity Forms RCE Flaw

CVE-2026-87796 Overview

CVE-2026-87796 is an unauthenticated arbitrary file upload vulnerability in the Multi Uploader for Gravity Forms plugin for WordPress. The flaw affects all versions up to and including 1.1.9 and resides in the move_file function, which fails to validate file types during chunked upload handling. Unauthenticated attackers can upload arbitrary files to the server, including PHP scripts, which may lead to remote code execution on the affected site. The vulnerability is classified as [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Unauthenticated attackers can upload arbitrary files and potentially execute code remotely on affected WordPress sites, leading to full server compromise.

Affected Products

Multi Uploader for Gravity Forms (WordPress plugin) versions up to and including 1.1.9
WordPress installations running the gf-multi-uploader plugin
Sites exposing the plugin's chunked upload endpoint to unauthenticated users

Discovery Timeline

2026-09-17 - CVE CVE-2026-87796 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87796

Vulnerability Analysis

The Multi Uploader for Gravity Forms plugin implements chunked file uploads through the GFMU_FileUploader component. During upload processing, the move_file function moves user-supplied uploads to a destination path without performing adequate validation of the file's type or extension. Because the chunked upload flow accepts input from unauthenticated requests, attackers can submit arbitrary payloads and place executable files inside the WordPress uploads directory.

Once a PHP file is written to a web-accessible path, requesting the file executes it in the context of the web server. This converts a file upload flaw into remote code execution, allowing attackers to install webshells, pivot to other applications, or exfiltrate database credentials from wp-config.php.

Root Cause

The root cause is insufficient file type validation in move_file and its supporting handlers in GFMUHandlePluploader.class.php and GFMU_FileUploader.php. Chunked upload logic reassembles file segments without enforcing an allow-list of MIME types or extensions before writing the final file to disk. The endpoint also lacks authentication and capability checks, which removes any barrier to abuse.

Attack Vector

Exploitation is performed remotely over the network with no authentication or user interaction. An attacker sends a crafted multipart request to the plugin's chunked upload endpoint with a PHP payload split across chunks. The server reassembles the chunks and stores the resulting file with the attacker-controlled extension. The attacker then requests the uploaded file directly to trigger PHP execution.

No verified public exploit code is available at the time of publication. Technical details are documented in the WordPress GF Multi Uploader source and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-87796

Indicators of Compromise

New or unexpected files with .php, .phtml, or .phar extensions in the WordPress wp-content/uploads/ directory or plugin-specific upload paths.
HTTP POST requests to gf-multi-uploader chunked upload endpoints originating from unauthenticated sessions.
Web server access logs showing direct GET requests to uploaded files with executable extensions.
Outbound network connections from the PHP-FPM or web server process to unfamiliar hosts after upload activity.

Detection Strategies

Review WordPress access logs for POST requests targeting the gf-multi-uploader plugin path from unauthenticated IPs.
Monitor the uploads directory for files that do not match the expected content types accepted by Gravity Forms.
Correlate file creation events in wp-content/uploads/ with subsequent HTTP requests to those same files.
Deploy web application firewall rules that block multipart uploads containing PHP tags or executable magic bytes.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress webroot to alert on new PHP files outside wp-includes/, wp-admin/, and known plugin directories.
Alert on child processes spawned by the web server user, such as sh, bash, curl, or wget.
Ingest WordPress and web server logs into a centralized SIEM for retention and cross-source correlation.

How to Mitigate CVE-2026-87796

Immediate Actions Required

Deactivate and remove the Multi Uploader for Gravity Forms plugin until a patched version is installed.
Audit the wp-content/uploads/ directory for unauthorized PHP files and remove any suspicious artifacts.
Rotate WordPress administrator credentials, database credentials, and API keys stored in wp-config.php if compromise is suspected.
Restrict access to the site or the plugin endpoints via IP allow-listing while remediation is in progress.

Patch Information

At the time of publication, all versions up to and including 1.1.9 are affected. Administrators should monitor the WordPress plugin repository and the Wordfence Vulnerability Analysis for an updated release and apply it immediately once available.

Workarounds

Block access to the plugin's upload endpoints at the web server or WAF layer until a patch is released.
Disable PHP execution within the wp-content/uploads/ directory using web server configuration.
Enforce authentication or CAPTCHA controls on any Gravity Forms that expose file upload fields.

bash

# Disable PHP execution in the WordPress uploads directory (Apache)
# Place in wp-content/uploads/.htaccess
<Files *.php>
    Order Deny,Allow
    Deny from all
</Files>

# Nginx equivalent — add inside the server block
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}