Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion

The impact of this vulnerability is severe. An unauthenticated attacker can leverage the insufficient file path validation in the 'pluploadajaxdelete_file' function to delete any file the web server process has write access to. This could include critical system files, configuration files, or sensitive data stored on the server. Successful exploitation could lead to denial of service, data breaches, or even complete system takeover, depending on the files deleted and the permissions of the web server user. The lack of authentication makes this vulnerability particularly concerning, as any user can attempt to exploit it.

WordPress websites utilizing the Multi Uploader for Gravity Forms plugin, particularly those with shared hosting environments or legacy configurations, are at significant risk. Sites with weak file system permissions or inadequate security practices are especially vulnerable. Administrators of WordPress sites using older versions of the plugin should prioritize upgrading to the patched version.

• wordpress: Use wp-cli plugin list to identify installations of the Multi Uploader for Gravity Forms plugin. Check the version number to determine if it's vulnerable.

wp plugin list --status=all | grep 'Multi Uploader for Gravity Forms'

• generic web: Monitor web server access logs for requests to /wp-content/plugins/multi-uploader-for-gravity-forms/delete.php or similar endpoints, especially those originating from unusual IP addresses. • generic web: Examine WordPress plugin files for the pluploadajaxdelete_file function and any related code that handles file path validation. Look for missing or inadequate validation checks. • linux / server: Monitor system logs (e.g., /var/log/auth.log, /var/log/syslog) for failed login attempts or unusual file deletion events related to the WordPress installation.

1. 2025-12-12Disclosure

   disclosure

1. Reservado2025-12-09
2. Publicada2025-12-12
3. Modificada2026-04-08
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-14344 is to immediately upgrade the Multi Uploader for Gravity Forms plugin to version 1.1.8 or later. If upgrading is not immediately feasible, consider restricting file upload permissions for the web server user to minimize the potential impact of file deletion. Implement a Web Application Firewall (WAF) rule to block requests to the 'pluploadajaxdelete_file' endpoint, especially those originating from untrusted sources. Regularly review file system permissions and audit logs for suspicious activity.

Instalações ativas

30

Avaliação do plugin