CVE-2026-87796

Name of the Vulnerable Software and Affected Versions Multi Uploader for Gravity Forms versions prior to 1.2.0

Description Insufficient file type validation during chunked upload handling in the move file() function allows unauthenticated attackers to upload arbitrary files to the server. This flaw can lead to remote code execution, which is the ability of an attacker to execute malicious commands on a remote machine over a network.

Recommendations As a temporary workaround, consider restricting the use of the move file() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.