VulnSocial

CVE-2026-87796Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 10 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 4 signals
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 6 signals
  • Disclosure: 6 classified signals
  • Peaked 2d ago at 7 mentions (2026-09-17); latest day: 1
  • 10 total mentions across 3 days

Deep dive

Activity timeline10 mentions / 3d
02457Mentions · 2026-09-17: 7Mentions · 2026-09-18: 2Mentions · 2026-09-19: 1PoC Mentioned / Linked · 2026-09-17: 3PoC Mentioned / Linked · 2026-09-18: 1Exploit Tool / Code · 2026-09-17: 1Patch / Workaround · 2026-09-18: 1Technical Details · 2026-09-17: 4Technical Details · 2026-09-18: 1Technical Details · 2026-09-19: 109-1709-1809-19
Signal classification2 categories
Disclosure
660.0%
PoC
440.0%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-09-177
Disclosure4PoC3
2026-09-182
Disclosure1PoC1
2026-09-191
Disclosure1
Full discourse10 posts
  • Rıdvan Yağlı@ridvanyagli
    PoC

    🔴 Güvenlik araştırmacısı @abraxas_null tarafından, WordPress Multi Uploader for Gravity Forms eklentisindeki CVE-2026-87796 kritik güvenlik açığı için PoC yayınlandı. 👉 Etkilenen sürümler: 1.1.9 ve öncesi PoC: https://github.com/abraxas/CVE-2026-87796

    Post summary

    The text announces the publication of a Proof of Concept (PoC) for CVE-2026-87796 in the WordPress Multi Uploader for Gravity Forms plugin, including a link to the PoC code on GitHub.

    56021141.8K
    2.5K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🔴 WordPress Multi Uploader for Gravity Forms eklentisinde kritik dosya yükleme açığı! Multi Uploader for Gravity Forms eklentisinde CVE-2026-87796 olarak takip edilen kritik bir açık keşfedildi. Bu açık halen düzeltilmiş değil! CVSS: 9.8 / Critica, Kimlik doğrulama gerektirmiyor, Keyfi dosya yüklemeye izin veriyor, RCE'ye yol açabiliyor! Açık, chunked file upload işlemi sırasında dosya türünün yeterince doğrulanmamasından kaynaklanıyor. Etkilenen sürümler: 1.1.9 ve öncesi ⚠️ Şu an CVE kaydında düzeltilmiş bir sürüm belirtilmiyor. Eklenti kullanılıyorsa güncelleme/yama yayınlanana kadar devre dışı bırakmayı düşünün. https://wordpress.org/plugins/gf-multi-uploader/

    Post summary

    The tweet announces CVE‑2026‑87796 in the WordPress Multi Uploader for Gravity Forms plugin, describing a critical (CVSS 9.8) remote code execution flaw affecting versions ≤1.1.9 and urging users to disable the plugin until a patch is released.

    1211252.8K
    2.5K followersView on X
  • abraxas@abraxas_null
    PoC

    fr3sh, h0t 0day s3rv3d!!! within 8 hours of CVE registration. no patch yet... CVE-2026-87796 - Multi Uploader for Gravity Forms <= 1.1.9 (CRITICAL 9.8) Unauthorized RCE https://github.com/abraxas/CVE-2026-87796 https://www.cve.org/CVERecord?id=CVE-2026-87796 https://t.co/apIKVuhUof

    Post summary

    The tweet announces a critical RCE in Gravity Forms Multi Uploader (CVE‑2026‑87796) and shares a GitHub repository that serves as a proof‑of‑concept, with no patch available yet.

    101634.4K
    636 followersView on X
  • abraxas@abraxas_null
    PoC

    Here's the full lab write-up, including the lab Dockerfile! https://abraxaslabs.tech/research/cve-2026-87796

    Post summary

    The author shares a link to a comprehensive lab write-up and Dockerfile for CVE-2026-87796, providing a reproducible environment and exploitation walkthrough consistent with a Proof of Concept release.

    0002191
    636 followersView on X
  • F@shinee_
    Disclosure

    CVE-2026-87796: Multi Uploader for Gravity Forms, unauthenticated RCE .. aquí el write Up 🔥https://abraxaslabs.tech/research/cve-2026-87796

    Post summary

    The tweet announces CVE-2026-87796 as an unauthenticated RCE vulnerability in Multi Uploader for Gravity Forms and shares a link to a research write-up, focusing on initial disclosure without explicit PoC, exploit, or remediation details.

    0101085
    1.2K followersView on X
  • CERT-PY@CERTpy
    Disclosure

    ⚠️ Vulnerabilidad en Complemento de WordPress ❗ CVE-2026-87796 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-complemento-de-wordpress-13/ https://t.co/vJ1oPASZhX

    Post summary

    The tweet serves as a notification disclosing a vulnerability in a WordPress plugin (CVE-2026-87796) and directs readers to a CERT Paraguay advisory for further details.

    00010260
    6.7K followersView on X
  • ADK Cyber@ADKCyber
    Disclosure

    CVE-2026-87796 (CVSS 9.8): Multi Uploader for Gravity Forms plugin for WordPress vulnerable to arbitrary file upload up to v1.1.9. Update promptly if deployed. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/QlKuWpxXGI

    Post summary

    The text is a vulnerability disclosure alert for CVE-2026-87796, a high-severity arbitrary file upload vulnerability in the Multi Uploader for Gravity Forms WordPress plugin, advising users to update.

    0000043
    97 followersView on X
  • abraxas@abraxas_null
    PoC

    @ridvanyagli FIRST! h0t 0day, serv3d fr3sh https://github.com/abraxas/CVE-2026-87796 https://t.co/EjtDuUDP7Z

    Post summary

    The tweet announces the discovery of CVE‑2026‑87796 and provides a GitHub link that likely contains a proof‑of‑concept, indicating the vulnerability’s PoC is now publicly shared.

    0000075
    107 followersView on X
  • Security Arsenal, LLC@SecurityAr58409
    Disclosure

    🔒 #CyberSecurity CVE-2026-87796: Critical Unauthenticated File Upload in Multi Uploader for Grav… "NVD has published CVE-2026-87796, a CVSS 9.8 (Critical) vulnerability in the Multi…" 🔗 https://securityarsenal.com/blog/cve-2026-87796-critical-unauthenticated-file-upload-in-multi-uploader-for-gravity-forms-detection-and-remediation-guide #CyberSecurity #ThreatIntel #cve202687796 #critical #cve

    Post summary

    The tweet discloses CVE-2026-87796, a critical unauthenticated file upload vulnerability with a CVSS 9.8 score, as published by NVD, and points to a detection and remediation guide.

    0000050
    34 followersView on X
  • LoreleiWeb@LoreleiWeb
    Disclosure

    🆕👉 Multi Uploader for Gravity Forms https://wpdeeply.com/multi-uploader-gravity-forms-1-1-9-unauthenticated-file-upload-cve-2026-87796/ #loreleiweb Multi Uploader for Gravity Forms 1.1.9 and earlier is vulnerable to an unauthenticated arbitrary file upload (CVE-2026-87796). Wordfence rates the issue Critical at CVSS 9.8. As of this advisory, Wordfe… https://t.co/lhGG6gm2JB

    Post summary

    The tweet announces CVE‑2026‑87796, an unauthenticated arbitrary file upload in Multi Uploader for Gravity Forms 1.1.9 and earlier, rated Critical with a CVSS score of 9.8.

    00000240
    85.8K followersView on X

Explore more

Back to dashboard