CVE-2026-87796

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

• CWE-434

• https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/GFMUAddon.class.php#L125
• https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMUHandlePluploader.class.php#L257
• https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L319
• https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L322
• https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L560
• https://www.wordfence.com/threat-intel/vulnerabilities/id/47337bc1-fa3d-470c-9524-859295261017?source=cve

Published

Sep 17, 2026

Last Modified

Sep 19, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8779A vulnerability was determined in omec-project amf up to 2.1…4.3
• CVE-2026-87791A path traversal vulnerability exists in the reserved_file_c…8.7
• CVE-2026-87792The "Design Scuole Italia" WordPress theme is affected by mu…8.7
• CVE-2026-87793The "Design Scuole Italia" WordPress theme is affected by a …5.1
• CVE-2026-87794bestzip versions 2.2.6 and 3.0.2 contain an argument injecti…8.4
• CVE-2026-87795zstd-jni versions before 1.5.7-14 fail to validate offset an…8.2
• CVE-2026-87797The Sprout Invoices WordPress plugin before 20.8.16 does no…4.3
• CVE-2026-8780A vulnerability was identified in omec-project amf up to 2.1…4.3
• CVE-2026-87802Improper verification of cryptographic signature vulnerabili…9.1
• CVE-2026-87803An authorization bypass vulnerability exists in the Countly …7.1
• CVE-2026-87804Rejected reason: no security impact
• CVE-2026-87806Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.…7.4