WordPress Plugin Vulnerabilities

Multi Uploader for Gravity Forms < 1.1.5 - Unauthenticated Arbitrary File Upload

Description

The plugin is vulnerable to arbitrary file uploads due to missing file type validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affects Plugins

Plugin icon
gf-multi-uploader
Fixed in 1.1.5

References

CVE
CVE-2025-23921
URL
https://patchstack.com/database/wordpress/plugin/gf-multi-uploader/vulnerability/wordpress-multi-uploader-for-gravity-forms-plugin-1-1-3-arbitrary-file-upload-vulnerability

Miscellaneous

Original Researcher
Colin Xu
Verified
No
WPVDB ID
8c6d0120-d32b-4645-bc7d-f26c70bbe526

Timeline

Publicly Published
2025-01-16 (about 1 year ago)
Added
2025-01-21 (about 1 year ago)
Last Updated
2025-04-17 (about 11 months ago)

Other

Published
Title
Published
2025-07-03
Title
Download Plugin < 2.2.9 - Authenticated (Administrator+) Arbitrary File Upload
Published
2021-07-01
Title
PWA for WP & AMP < 1.7.33 - Authenticated (Subscriber+) Settings Change
Published
2024-09-25
Title
Advanced File Manager < 5.2.9 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2024-10-14
Title
Digital Lottery <= 3.0.5 - Unauthenticated Arbitrary File Upload
Published
2024-11-08
Title
The Novel Design Store Directory <= 4.3.0 - Unauthenticated Arbitrary File Upload