The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. Th…

CVE-2026-5581 affects the Multi Uploader for Gravity Forms WordPress plugin in all versions up to and including 1.1.8. The vulnerability allows unauthenticated attackers to permanently delete any WordPress media attachment by supplying its attachment ID. The root cause is a missing capability check in the plupload_ajax_delete_file() function, registered via the wp_ajax_nopriv_gfmu_delete_file hook, which allows unauthenticated AJAX calls. A nonce intended for CSRF protection is inadvertently exposed on any public-facing page containing a multi-uploader form field through the GFMU_options JavaScript object. Exploitation could lead to complete destruction of a site's media library. No authentication is required, making this a critical unauthenticated vulnerability. A patch is available in the plugin trunk repository.