Arbitrary File Deletion Vulnerability in Gravity Forms Multi Uploader Plugin for WordPress

CVE-2025-14344

What is CVE-2025-14344?

The Gravity Forms Multi Uploader plugin for WordPress contains a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server due to insufficient validation of file paths in the 'plupload_ajax_delete_file' function. This flaw is present in all versions up to and including 1.1.7, potentially leading to significant data loss and server compromise. Site administrators should take immediate action to mitigate this risk by updating the plugin or employing alternative security measures.

References