Advisory (from the source map)

The advisory names move_file. That is a private PHP method, not HTTP action=. The HTTP action is gfmu-plupload-submit. Chunked vs non-chunked is REQUEST[chunks]>1. PHP function names are not admin-ajax action=.

Entry

• Method: POST
• Path: /wp-admin/admin-ajax.php
• Router: wp_ajax_nopriv_gfmu-plupload-submit → GFMUHandlePluploader::plupload_ajax_submit. Nonce field is REQUEST[nonce] for action gfmu-upload-nonce. Do not invent a different ajax action.
• Notes: CVE-2026-87796: chunked handleUpload (REQUEST chunks>1) copies the assembled file with move_file BEFORE validateUploadedFile. Non-chunked validates first. Without a field, enable_chunked is false and toBytes(ini 2M) < sizeLimit 10mb returns 'try activate chunking' before any write. Lab stub RGFormsModel::get_field returns a multi-uploader field with chunk_size=2mb so that check is skipped. Send currentFormID=1 and currentFieldID=1. Discover nonce from page slug gfmu-lab-nonce. Witness GET /wp-content/uploads/gfmu-uploads-tmp/poc_witness.php contains POC_WITNESS_87796 (GIF89a + echo, not a shell). Two chunk POSTs then GET.

Call chain

• POST /wp-admin/admin-ajax.php action=gfmu-plupload-submit (nopriv, GFMUAddon.class.php:125)
• GFMUHandlePluploader::plupload_ajax_submit nonce gfmu-upload-nonce (GFMUHandlePluploader.class.php:257-262)
• GFMU_FileUploader::handleUpload chunks>1 (GFMU_FileUploader.php:231-319)
• move_file copy then unlink tmp (GFMU_FileUploader.php:319, 545-560)
• validateUploadedFile only AFTER the file is already at $target (322) — unlike non-chunked which validates first (375)
• GET /wp-content/uploads/gfmu-uploads-tmp/<name> for POC_WITNESS_87796

Lab preconditions

• WordPress with gf-multi-uploader 1.1.9 active
• Lab GF stub mu-plugin so GFForms exists and nopriv AJAX registers
• Public page slug gfmu-lab-nonce with GFMU_NONCE= for uid 0
• Do not pass currentFormID (no real Gravity Forms forms)

Witness

HTTP GET of the uploaded file returns the unique string POC_WITNESS_87796. JSON result=success plus that GET is SUCCESS. Theme HTML, admin-ajax 0, or Server error. nonce fail is not it.

Not success

• generic 200 hello world HTML
• admin-ajax 400 body 0
• result error / Server error. nonce
• invalid extension without a file that still GETs the witness
• a reverse shell or outbound connect
• uploading an allowed jpg/png that is not the arbitrary-type sink

Patch / remediation

Do this first: Apply the vendor patch for Multi Uploader for Gravity Forms. See references.

Verify after upgrade

• Re-run CVE-2026-87796-Abraxas-Labs.py against the patched build: the mapped witness must not appear.
• Confirm the vendor advisory / changeset in the deployed tree (see references).
• A WAF signature is delay, not a patch.

If you cannot update immediately

• Disable or isolate the affected component.
• Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).

Reproduction (authorized lab)

Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.

Success is the witness above in the response body. Generic 200 HTML is not it.

Lab images

Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.

• lab/docker-compose.yml
• lab/docker-compose.override.yml
• lab/Dockerfile

Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.

References

• CVE-2026-87796 · NVD

• CVE-2026-87796 · CVE.org

• plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/GFMUAddon.class.php#L125

• plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMUHandlePluploader.class.php#L257

• plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L319

• plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L322

• plugins.trac.wordpress.org/browser/gf-multi-uploader/tags/1.1.9/inc/GFMU_FileUploader.php#L560

• www.wordfence.com/threat-intel/vulnerabilities/id/47337bc1-fa3d-470c-9524-859295261017?source=cve

• github.com/advisories/GHSA-h7vp-g8q2-89c8

• nvd.nist.gov/vuln/detail/CVE-2026-87796

• Plugin directory: gf-multi-uploader

• Trac browser: plugins.trac.wordpress.org/gf-multi-uploader

• SVN tags: plugins.svn.wordpress.org/gf-multi-uploader

• Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null

Records (structured)

Disclaimer

This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.

abraxaslabs.tech · github.com/abraxas · @abraxas_null