CVE-2025-14344 - Multi Uploader for Gravity Forms <= 1.1.7 - unauthenticated arbitrary file deletion

CVE ID : CVE-2025-14344 Published : Dec. 12, 2025, 4:15 a.m. | 1 hour, 30 minutes ago Description : The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_ajax_delete_file' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor