What is the CVSS score of CVE-2026-5581?

CVE-2026-5581 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Multi Uploader for Gravity Forms are affected by CVE-2026-5581?

The Multi Uploader for Gravity Forms WordPress plugin (versions through 1.1.8) allows unauthenticated attackers to permanently delete media library attachments.

How to fix or mitigate CVE-2026-5581?

Within 24 hours, identify all WordPress installations using the Multi Uploader for Gravity Forms plugin (versions 1.1.8 and earlier) through WordPress plugin audit tools and restrict plugin access to authenticated administrators only via network firewall rules. Within 7 days, deactivate and remove the plugin from all affected WordPress installations-alternatively, update to the patched version if the vendor releases a security update. Within 30 days, verify that media library audit logs have been reviewed for deletion anomalies during the exposure window and restore any deleted media from encrypted backups if exploitation is identified.

Multi Uploader for Gravity Forms CVE-2026-5581

EUVD-2026-53170 CRITICAL

Missing Authorization (CWE-862)

2026-08-05 Wordfence

GHSA-56hx-w84f-pp3h

WordPress Authentication Bypass CSRF Wordpress Plugin Multi Uploader For Gravity Forms

9.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Remote unauthenticated nopriv endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N); deletion destroys data giving I:H and A:H, with no data disclosure so C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:45 vuln.today

CVE Published

Aug 05, 2026 - 06:37 cve.org

CRITICAL 9.1

DescriptionCVE.org

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the plupload_ajax_delete_file() function, which is registered via wp_ajax_nopriv_gfmu_delete_file. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-uploader form field via the GFMU_options JavaScript object. This makes it possible for unauthenticated attackers to permanently delete any WordPress media attachment by supplying its attachment ID, potentially leading to complete media library destruction.

Articles & Coverage 1

News Critical Unauthorized Media Deletion in WordPress Multi Uploader for Gravity Forms - CVE-2026-5581 Aug 05, 2026

AnalysisAI

Unauthorized arbitrary media deletion in the Multi Uploader for Gravity Forms WordPress plugin (all versions through 1.1.8) lets unauthenticated attackers permanently destroy any media library attachment. The flaw stems from the AJAX file-delete handler being wired to the nopriv hook without a capability check, while the CSRF nonce is leaked in page source, defeating the only protection present. No public exploit is identified at time of analysis, but exploitation is trivial and the EPSS/KEV signals are not yet populated for this recently disclosed issue.

Technical ContextAI

The plugin extends Gravity Forms with a Plupload-based multi-file uploader (the affected code lives in GFMUHandlePluploader.class.php and GFMUAddon.class.php). The delete routine plupload_ajax_delete_file() is registered through wp_ajax_nopriv_gfmu_delete_file, meaning WordPress dispatches it for logged-out visitors. This is a textbook CWE-862 (Missing Authorization): the handler performs a privileged operation (wp_delete_attachment on an attacker-supplied attachment ID) without verifying current_user_can()/manage capabilities. The nonce meant to enforce CSRF protection is printed into the public-facing GFMU_options JavaScript object on any page rendering a multi-uploader field, so it provides no real access control. CPE cpe:2.3:a:sh1zen:multi_uploader_for_gravity_forms confirms the single affected vendor package.

RemediationAI

Update to the fixed release published in the WordPress.org repository via changeset 3501985 (https://plugins.trac.wordpress.org/changeset?new=3501985%40gf-multi-uploader%2Ftrunk&old=3421317%40gf-multi-uploader%2Ftrunk); the exact tagged version above 1.1.8 is not stated in the provided data, so verify the latest available version in the plugin listing before applying. If you cannot update immediately, deactivate the Multi Uploader for Gravity Forms plugin (trade-off: multi-file upload fields stop working) or remove/unpublish any public pages containing a multi-uploader form field to prevent the nonce from being exposed and the nopriv endpoint from being reachable in a useful way. As a network-layer control, block or challenge unauthenticated POST requests to admin-ajax.php carrying action=gfmu_delete_file via a WAF rule (trade-off: legitimate front-end deletions during upload will also be blocked). Consult the Wordfence advisory above for the authoritative fix version.