External risk intelligence

Multi Uploader for Gravity Forms WordPress Plugin Unauthorized Media Deletion Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-5581

The vulnerability exists in a WordPress plugin designed for public-facing web forms. The vulnerable function is explicitly registered to be accessible to unauthenticated users via the WordPress AJAX handler, making the attack surface an internet-facing web endpoint reachable by any visitor.

Cross-site Request Forgery

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability in the Multi Uploader for Gravity Forms WordPress plugin allows unauthenticated attackers to delete any media attachment. This could lead to the destruction of the entire media library.

Unauthorized media deletion affects WordPress.
Confirms relevance and exposure to WordPress media loss.
Verify if WordPress media deletion is a concern.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by leveraging a publicly exposed nonce found on any page with a multi-uploader form. By identifying the attachment ID of a media file, the attacker can trigger the vulnerable function to delete that file, potentially leading to the destruction of the entire media library.

Accessible via public-facing forms.
Triggers deletion of media attachments.
Risk of complete media library destruction.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to delete any media file from a WordPress site when the Multi Uploader for Gravity Forms plugin is present and a multi-uploader form is displayed. This could lead to the permanent removal of all media attachments within the WordPress media library.

Media attachments
Via exposed JavaScript object
Complete media library destruction

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in a WordPress plugin affects any site utilizing the Multi Uploader for Gravity Forms. The primary teams to engage would be the application owners responsible for the WordPress instances and the platform or infrastructure teams managing the web servers. The immediate first step is to identify all WordPress sites using this plugin, confirm their exposure and criticality, and then assign ownership for remediation planning.

WordPress application owners must triage.
Verify plugin usage and exposure.
Plan remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Multi Uploader for Gravity Forms plugin?

This is an add-on for the popular Gravity Forms plugin on WordPress. It allows website visitors to upload multiple files, such as images or documents, directly through a form on a webpage. Site owners typically use it to let users submit content or attachments as part of a contact form or application process.

How would you describe the weakness in CVE-2026-5581?

This vulnerability is classified as CWE-862, which is a Missing Authorization error. In plain terms, the plugin fails to check if a person is authorized to delete a file before performing that action. Because the code lacks this mandatory permission step, it essentially trusts any request it receives, even if the person sending it has no valid account or administrative rights.

Does simply visiting a page with the plugin trigger this bug?

No. Merely viewing a page that contains a multi-uploader form does not automatically delete your files. The vulnerability requires an attacker to intentionally send a specific network request that targets a valid media attachment ID. The bug is triggered when that unauthorized request reaches the plugin's file-handling function.

Why is this a concern for public-facing WordPress sites?

Halo Surface Signal notes that because this plugin is designed for public forms, the vulnerable function is reachable by any visitor via the internet. If your site uses this plugin and exposes these forms to the public, an attacker can discover the necessary security token on your page and use it to delete items from your media library remotely.

What should I do if I run this WordPress plugin?

First, identify every site you manage that has this plugin installed. Once you have a list, determine which sites are currently using the multi-uploader feature on public pages. Prioritize these for review, coordinate with your technical team to restrict access or remove the vulnerable form, and check for official plugin updates that include a security patch.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.