The Multi Uploader for Gravity Forms plugin suffers from a path traversal vulnerability (CWE-22) in the 'plupload_ajax_delete_file' function. This improper limitation of pathname allows unauthenticated attackers to craft requests that delete arbitrary files on the server. The vulnerability affects all plugin versions up to and including 1.1.7. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or remediation details are currently available from the vendor or advisory sources.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the affected server, potentially leading to denial of service, data loss, or further compromise depending on the files deleted. The high CVSS score (9.8) indicates critical impact on confidentiality, integrity, and availability of the system running the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable plugin functionality, disable or remove the plugin if possible, and monitor for suspicious activity related to file deletion attempts targeting the plugin endpoints.