Missing authorization to unauthenticated arbitrary media deletion in Multi Uploader for Gravity Forms (CVE-2026-5581)

The Multi Uploader for Gravity Forms WordPress plugin contains missing capability checks in the `plupload_ajax_delete_file()` function, registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-uploader form field via the `GFMU_options` JavaScript object, allowing unauthenticated attackers to permanently delete any WordPress media attachment by supplying its attachment ID, potentially leading to complete media library destruction. Affected versions: - <= 1.1.8 We recommend updating to: 1.1.9. CVSS 9.1 · our assessment: act_now Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/16dca898-1a98-4e0b-8f48-dc01ba2dc4e6?source=cve Details: https://vuln.today/cve/CVE-2026-5581