The vulnerability in the sh1zen Multi Uploader for Gravity Forms plugin allows an attacker with web access to upload files of arbitrary type. This weakness, identified as CWE‑434, permits the upload of a web shell to the server, granting the attacker the ability to execute arbitrary code and potentially compromise the entire site’s integrity and confidentiality.

The affected product is sh1zen Multi Uploader for Gravity Forms, specifically all releases from the initial version up to and including 1.1.3. Users of any pre‑1.1.4 build are potentially impacted and should review their installation version.

The CVSS base score of 9.0 reflects the severe risk of remote code execution. However, the EPSS score of less than 1% indicates a very low probability that the flaw will be actively exploited at this time, and the flaw has not yet been listed in the CISA KEV catalog. Attackers would likely exploit the flaw by uploading a malicious file via the plugin’s file upload interface, which is accessible to any authenticated or potentially unauthenticated user depending on site configuration. Because the flaw permits arbitrary file types, the risk remains high once exploited.