An unauthenticated arbitrary file upload vulnerability in the sh1zen Multi Uploader for Gravity Forms plugin poses a critical risk of remote code execution.

This vulnerability occurs due to insufficient file type validation during chunked upload handling within the move_file function. An unauthenticated attacker can leverage this flaw to upload malicious files to the server, which can subsequently be executed to achieve remote code execution.

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation grants an attacker full control over the affected server, potentially leading to total system compromise, data exfiltration, and significant service disruption.

Immediate Action: There is currently no confirmed patch available for this vulnerability. Administrators should immediately deactivate or uninstall the Multi Uploader for Gravity Forms plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious file upload requests, particularly those targeting the plugin's upload directory or unusual file extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads and inspect incoming HTTP requests for common malicious file signatures.

Public Exploit Available: No (unknown)

Given the critical nature of this vulnerability and the lack of a vendor-provided patch, immediate removal or deactivation of the plugin is the only effective way to mitigate risk. Organizations should prioritize this task to prevent potential remote code execution attacks against their infrastructure.