PT-2025-50865 · WordPress+1 · Multi Uploader For Gravity Forms+1

Published 2025-12-12 · Updated 2025-12-17 · CVE-2025-14344

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Multi Uploader for Gravity Forms plugin versions up to and including 1.1.7

Description The Multi Uploader for Gravity Forms plugin for WordPress is susceptible to arbitrary file deletion. Insufficient file path validation within the plupload ajax delete file function allows unauthenticated attackers to delete arbitrary files on the server.

Recommendations Update Multi Uploader for Gravity Forms plugin to a version later than 1.1.7.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-14344

Affected Products

Gravity Forms

Multi Uploader For Gravity Forms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14344 · Security Note
• https://twitter.com/cracbot/status/2001246045356089505 · Twitter Post
• https://twitter.com/0dayPublishing/status/1999323453036384386 · Twitter Post
• https://t.me/CVEtracker/39564 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/346af237-0411-4cc4-9544-eab697385a2f?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3421317 · Note
• https://plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.7/inc/GFMUHandlePluploader.class.php?marks=41-43#L41 · Note
• https://twitter.com/CveFindCom/status/1999338182186238284 · Twitter Post