CyberRota Analysis
AI-GeneratedThe Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to inadequate file type validation in the move_file function, affecting all versions up to 1.1.9. This flaw allows unauthenticated attackers to upload malicious files, potentially leading to remote code execution on the server. WordPress site administrators using this plugin should prioritize immediate updates to mitigate this critical security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.