PHP Object Injection Vulnerability in Gravity Forms Plugin for WordPress
CVE-2026-103039

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Gravity Forms
Vendor
CVE Published:
30 October 2026

What is CVE-2026-103039?

The Gravity Forms plugin for WordPress, up to version 3.1.2, is vulnerable to PHP Object Injection via a List input type in Post Custom Fields. This vulnerability arises from the improper use of WordPress' global maybe_unserialize() function in GFFormsModel::create_post(), which does not enforce necessary restrictions on the submitted values. Attackers can exploit this flaw to inject malicious PHP objects into post metadata. While the plugin does not contain a PHP Object Injection gadget chain, an additional plugin or theme could facilitate further exploitation, such as remote code execution if specific conditions are met. Notably, if the custom field maps to protected meta keys, vulnerable paths may be exposed, presenting heightened risks to affected installations.

Affected Version(s)

Gravity Forms 0 <= 3.1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://docs.gravityforms.com/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tin Pham (TF1T)
Hao Ngo
Trong Pham
.