CVE-2026-87796: Critical Unauthenticated File Upload in Multi Uploader for Gravity Forms — Detection and Remediation Guide

---
title: Web Server Process Writing Executable File to WordPress Uploads Directory
id: 8b4e2c1a-6f3d-4a5b-9c7e-2d1f0a8b6c4d
status: experimental
description: Detects a web server or PHP process writing a PHP/script file into the WordPress uploads directory, consistent with arbitrary file upload exploitation such as CVE-2026-87796.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87796
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - '/php'
  selection_target:
    TargetFilename|contains: '/wp-content/uploads/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
      - '.pht'
  condition: selection_process and selection_target
falsepositives:
  - Legitimate plugin or theme installation/update performed through the WordPress admin panel
  - Developer deployments to staging paths under uploads (uncommon)
level: high
---
title: Web Server Process Spawning Shell or Command Interpreter (Web Shell Behavior)
id: 3c7a9f2e-1d5b-4e8a-b6c9-0f2a4d8e1b3c
status: experimental
description: Detects web server or PHP-FPM worker processes spawning shells or common post-exploitation tools, a strong indicator of web shell execution following arbitrary file upload (e.g., CVE-2026-87796).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87796
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1505.003
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/whoami'
      - '/id'
  condition: selection_parent and selection_child
falsepositives:
  - Rare plugin functionality invoking system commands (e.g., image processing via exec) — investigate parent-child context
level: critical
---
title: Suspicious HTTP POST to Gravity Forms Multi Uploader Endpoint
id: 5e1b8d4c-2a7f-4c3e-8d6a-9b0c3e5f7a2d
status: experimental
description: Detects POST requests to admin-ajax.php carrying Gravity Forms multi-uploader action parameters, potentially indicating chunked upload abuse related to CVE-2026-87796. Tune the action value to your plugin's observed AJAX handler.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87796
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/wp-admin/admin-ajax.php'
      - 'admin-ajax.php'
  selection_method:
    cs-method: 'POST'
  selection_payload:
    cs-body|contains:
      - 'move_file'
      - 'chunk'
      - 'multi_uploader'
      - 'multiuploader'
      - 'gform'
  condition: selection_uri and selection_method and selection_payload
falsepositives:
  - Legitimate form submissions using the multi-uploader field — baseline volume per source IP and flag anomalous spikes or requests from non-user geographies/ASNs
level: medium

// Hunt 1: POST attempts against WordPress AJAX upload endpoints with multi-uploader characteristics
// Adjust table/columns to your log source (CommonSecurityLog for CEF-forwarded WAF/proxy logs)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestMethod =~ "POST"
| where RequestURL has "admin-ajax.php"
| where AdditionalExtensions has_any ("multi_uploader", "multiuploader", "move_file", "chunk")
    or RequestURL has_any ("multi_uploader", "multiuploader")
| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, RequestURL, DestinationHostName
| where Attempts > 3 or FirstSeen > ago(72h)
| order by LastSeen desc;

// Hunt 2: Web server worker process creating script files in WordPress uploads (IIS-hosted WordPress on Windows)
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("w3wp.exe", "php-cgi.exe", "php.exe", "httpd.exe")
| where FolderPath has @"\wp-content\uploads\"
| where FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".aspx" or FileName endswith ".pht"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA256, InitiatingProcessAccountName
| order by TimeGenerated desc;

// Hunt 3: Web server process spawning command interpreters (post-exploitation behavior)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("w3wp.exe", "php-cgi.exe", "httpd.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "whoami.exe", "certutil.exe", "curl.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

-- Hunt for recently created script files inside WordPress uploads directories
-- Indicates possible web shell deployment via arbitrary file upload (CVE-2026-87796)
LET cutoff = time() - 14*24*3600

SELECT FullPath AS FilePath,
       Mtime.Sec AS ModifiedEpoch,
       timestamp(epoch=Mtime.Sec) AS ModifiedTime,
       Size AS FileSize,
       Mode AS Permissions
FROM glob(globs=[
    '/var/www/**/wp-content/uploads/**/*.php',
    '/var/www/**/wp-content/uploads/**/*.phtml',
    '/var/www/**/wp-content/uploads/**/*.pht',
    '/var/www/**/wp-content/uploads/**/*.phar',
    '/srv/www/**/wp-content/uploads/**/*.php',
    '/home/**/public_html/wp-content/uploads/**/*.php'
])
WHERE Mtime.Sec > cutoff
ORDER BY Mtime.Sec DESC

#!/bin/bash
# CVE-2026-87796 - Multi Uploader for Gravity Forms verification & hardening
# Run as root or with sudo on the WordPress host

set -u

WP_ROOTS="/var/www /srv/www /home"
echo "=== [1/4] Locating Multi Uploader for Gravity Forms installations ==="
for root in $WP_ROOTS; do
  [ -d "$root" ] || continue
  find "$root" -type d -name "multi-uploader-for-gravity-forms" 2>/dev/null | while read -r plugindir; do
    echo "FOUND plugin directory: $plugindir"
    # Extract plugin version from the main plugin file header
    mainfile=$(grep -rl "Version:" "$plugindir" --include="*.php" 2>/dev/null | head -1)
    if [ -n "$mainfile" ]; then
      ver=$(grep -m1 "Version:" "$mainfile" | awk '{print $NF}')
      echo "  Detected version: $ver"
      # Flag vulnerable versions (1.1.9 and below)
      if printf '%s\n1.1.9\n' "$ver" | sort -V -C; then
        echo "  STATUS: VULNERABLE (<= 1.1.9) - update or deactivate immediately"
      else
        echo "  STATUS: appears patched (> 1.1.9) - verify against vendor advisory"
      fi
    fi
  done
done

echo "=== [2/4] Searching uploads directories for PHP/script files (potential web shells) ==="
for root in $WP_ROOTS; do
  [ -d "$root" ] || continue
  find "$root" -type d -path "*/wp-content/uploads" 2>/dev/null | while read -r updir; do
    hits=$(find "$updir" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.pht" -o -name "*.phar" \) -mtime -30 2>/dev/null)
    if [ -n "$hits" ]; then
      echo "SUSPICIOUS FILES in $updir (created/modified in last 30 days):"
      echo "$hits" | while read -r f; do ls -la "$f"; done
    fi
  done
done

echo "=== [3/4] Checking for PHP execution blocking in uploads (.htaccess / nginx config) ==="
for root in $WP_ROOTS; do
  [ -d "$root" ] || continue
  find "$root" -type d -path "*/wp-content/uploads" 2>/dev/null | while read -r updir; do
    if [ ! -f "$updir/.htaccess" ]; then
      echo "No .htaccess in $updir - applying Apache hardening"
      cat > "$updir/.htaccess" <<'EOF'
# Block PHP execution in uploads - CVE-2026-87796 mitigation
<FilesMatch "\.(php|phtml|phar|pht|php[0-9])$">
  Require all denied
</FilesMatch>
EOF
      chown --reference="$updir" "$updir/.htaccess" 2>/dev/null || true
      echo "  Wrote $updir/.htaccess"
    else
      echo "  $updir/.htaccess exists - manually verify it blocks PHP execution"
    fi
  done
done

echo "=== [4/4] Reviewing web access logs for suspicious chunked upload POSTs (last 7 days) ==="
for log in /var/log/apache2/access.log /var/log/httpd/access_log /var/log/nginx/access.log; do
  [ -f "$log" ] || continue
  echo "--- $log ---"
  grep -E "POST.*admin-ajax\.php" "$log" 2>/dev/null \
    | grep -iE "multi_uploader|multiuploader|move_file|chunk" \
    | awk '{print $1, $4, $6, $7}' | sort | uniq -c | sort -rn | head -20
done

echo "=== DONE. Patch the plugin via wp-admin or WP-CLI: wp plugin update multi-uploader-for-gravity-forms ==="