CVE-2025-14344
Arbitrary File Deletion in Gravity Forms Multi Uploader Plugin
Publication date: 2025-12-12
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gravity_forms | multi_uploader | 1.1.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Multi Uploader for Gravity Forms WordPress plugin, where the 'plupload_ajax_delete_file' function does not properly validate file paths. This flaw allows unauthenticated attackers to delete arbitrary files on the server.
How can this vulnerability impact me? :
This vulnerability can lead to severe impacts including deletion of critical files on the server, potentially causing denial of service, data loss, or disruption of website functionality. Since attackers do not need authentication, the risk is high.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated attackers to delete arbitrary files on the server, which can lead to loss of data integrity and availability. Such unauthorized file deletion could result in non-compliance with standards and regulations like GDPR and HIPAA that require protection of data integrity, availability, and confidentiality. Specifically, it may violate requirements for safeguarding personal or sensitive data, potentially leading to data breaches or loss of critical information. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for unauthorized or suspicious HTTP requests targeting the 'plupload_ajax_delete_file' AJAX endpoint in the Gravity Forms Multi Uploader plugin. Since the vulnerability allows unauthenticated arbitrary file deletion, you can look for POST requests to this endpoint without valid WordPress nonces or from unexpected IP addresses. Commands to detect such activity could include using web server logs or network monitoring tools. For example, using grep on Apache or Nginx logs: `grep 'plupload_ajax_delete_file' /var/log/apache2/access.log` or `grep 'plupload_ajax_delete_file' /var/log/nginx/access.log` to find deletion attempts. Additionally, monitoring for unexpected file deletions in the WordPress uploads directory (especially the 'gfmu-uploads-tmp' folder) can help detect exploitation attempts. However, no specific detection commands are provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Gravity Forms Multi Uploader plugin to a version later than 1.1.7 where the vulnerability is fixed. If an update is not immediately available, restrict access to the AJAX endpoint 'plupload_ajax_delete_file' by implementing firewall rules or web application firewall (WAF) rules to block unauthenticated requests. Additionally, verify that WordPress nonces are properly enforced and consider disabling or limiting the use of the vulnerable plugin until a patch is applied. Monitoring and backing up files regularly can also help mitigate damage from exploitation. [2]