Deserialization of Untrusted Data Vulnerability in Gravity Forms by Rocketgenius, Inc.
CVE-2026-97296

8.1HIGH

Key Information:

Vendor

WordPress
Status
Gravity Forms
Vendor
CVE Published:
16 October 2026

What is CVE-2026-97296?

A vulnerability exists in Gravity Forms due to deserialization of untrusted data, which can lead to object injection attacks. This flaw potentially allows malicious actors to manipulate data without proper validation, impacting the integrity of the application. Users are advised to update to version 3.1.1 or later to mitigate any risks associated with this issue.

Affected Version(s)

Gravity Forms 0 < 3.1.1

References

https://patchstack.com/database/wordpress/plugin/gravityf...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0xd4rk5id3 | Patchstack Bug Bounty Program
.