Critical Vulnerabilities in Grav and Gravity Forms Plugins Exploited

• •CVE-2026-75827 in Grav allows remote code execution via arbitrary file writes.
• •CVE-2026-87796 in Gravity Forms enables unauthenticated file uploads, risking remote code execution.
• •Both vulnerabilities have PoCs available, increasing the urgency for patching.

Two significant vulnerabilities have been disclosed affecting Grav and the Multi Uploader for Gravity Forms plugin. Grav versions up to 2.0.13 are vulnerable to an arbitrary file write issue (CVE-2026-75827), allowing attackers with specific access to execute remote code. The Multi Uploader for Gravity Forms plugin, up to version 1.1.9, suffers from an arbitrary file upload vulnerability (CVE-2026-87796), enabling unauthenticated attackers to upload malicious files. Both vulnerabilities have been assigned high to critical CVSS scores, with CVE-2026-87796 rated at 9.8. Proof-of-concept (PoC) exploits are available for both vulnerabilities, raising concerns about their potential exploitation in the wild. Security professionals are advised to update affected systems immediately to mitigate risks.