The vulnerability resides in the Multi Uploader for Gravity Forms plugin for WordPress through a missing capability check in the plupload_ajax_delete_file() function that is registered via the unauthenticated AJAX hook wp_ajax_nopriv_gfmu_delete_file. The AJAX endpoint accepts an attachment ID and removes the corresponding media file from the WordPress library. Because the CSRF protection nonce is exposed in the GFMU_options JavaScript object on any page that displays a multi‑uploader form, an attacker who can view the page can obtain the nonce and send a crafted request to delete any attachment. The result is permanent loss of media attachments, potentially destroying the entire media library. The weakness is a missing authorization (CWE‑862) and can lead to complete data loss.

The flaw affects the Multi Uploader for Gravity Forms plugin version 1.1.8 and all older releases. It applies to WordPress sites that have this plugin installed and have multi‑uploader form fields accessible to unauthenticated visitors.

The CVSS score of 9.1 indicates a critical level of risk, with high impact and availability of an unauthenticated exploitation path. EPSS is not available, but the lack of an authentication requirement and the publicly exposed nonce mean attackers can easily exploit the flaw. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but its critical score and straightforward attack vector warrant immediate attention.