CVE-2026-5581

Name of the Vulnerable Software and Affected Versions Multi Uploader for Gravity Forms versions prior to 1.1.9

Description Unauthenticated attackers can permanently delete any WordPress media attachment by providing its attachment ID. This issue occurs because the plupload ajax delete file() function, registered via wp ajax nopriv gfmu delete file, lacks necessary capability checks. Additionally, the nonce used for Cross-Site Request Forgery (CSRF) protection—a security token used to prevent unauthorized commands from being transmitted from a user that the web application trusts—is exposed on public pages containing a multi-uploader form field through the GFMU options JavaScript object.

Recommendations Update Multi Uploader for Gravity Forms to a version newer than 1.1.8.