Zero Radar
← feed
CriticalVulnerabilityCVE-2026-103039updated 30 Oct 2026, 11:08 UTC

Gravity Forms WordPress plugin can let attackers inject harmful data (up to 3.1.2)

Attackers who can reach a website's form can slip in specially crafted data that the site then trusts and processes as code-like objects. On some sites this can lead to an attacker taking control of the server.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerSubmits crafted data via a public form
  2. 2Gravity Forms processes inputValue passed to unrestricted maybe_unserialize()
  3. 3Object stored in post metaInjected PHP object persists in the database
  4. 4Gadget chain triggeredNeeds a vulnerable plugin or theme present
  5. ResultAttacker may gain remote code execution

What happened

Gravity Forms up to and including 3.1.2 passes unvalidated form input to WordPress's unrestricted maybe_unserialize() in GFFormsModel::create_post(), enabling unauthenticated PHP Object Injection into post meta when a List-type Post Custom Field has a content template enabled.

Why it is dangerous: No direct exploit is shown in the plugin alone, but if a suitable gadget chain exists in another plugin or theme, the flaw could enable remote code execution. Sites using affected Gravity Forms versions with List-type post custom fields are at risk, especially where a PEAR install is readable and register_argc_argv is enabled.

Are you affected?

You are affected if you run Gravity Forms 3.1.2 or earlier on WordPress with a form that uses a Post Custom Field of type List with a content template enabled.

Gravity Forms plugin for WordPress, all versions up to and including 3.1.2

What to do

  1. Check whether your Gravity Forms version is 3.1.2 or earlier and update to the fixed version once released by the vendor
  2. Until patched, disable or review forms using List-type Post Custom Fields with content templates
  3. Audit installed plugins and themes for PHP object injection gadget chains and remove unused ones

Timeline

  1. 30 Oct 2026, 07:16 UTC
    Publicly disclosed
  2. 30 Oct 2026, 07:16 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 07:19 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 11:08 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-103039 · GHSA-635p-78xg-j6w3
CVSS
9.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
30 Oct 2026, 07:16 UTC
On Zero Radar
30 Oct 2026, 07:19 UTC (3 min after disclosure)
Last change
30 Oct 2026, 11:08 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Gravity Forms WordPress plugin can let attackers inject harmful data (up to 3.1.2) · Zero Radar