CVE-2026-103039: Remote Code Execution in Gravity Forms for WordPress

Critical RCE in Gravity Forms WordPress through PHP Object Injection. CVSS 9.8, unauthenticated.

CVE-2026-103039 is a critical PHP Object Injection vulnerability in the Gravity Forms plugin for WordPress. The flaw is in GFFormsModel::create_post(), which passes unfiltered values to global maybe_unserialize() instead of the hardened GFCommon::maybe_unserialize() from v3.1.1. It affects versions up to 3.1.2, allowing unauthenticated attackers to inject arbitrary PHP objects into post meta via List-type custom fields with content template enabled.

CVSS score is 9.8. No gadget chain exists within the plugin, but other plugins or themes might provide one enabling RCE. If the field is mapped to _wp_page_template, WordPress internally supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() resolves attacker-controlled paths, and on hosts with readable PEAR and register_argc_argv enabled this yields RCE. Social media signals indicate awareness in the last 24 hours.

Update Gravity Forms immediately beyond version 3.1.2. Verify WordPress inventory and prioritize patching. If immediate updates are not feasible, disable List-type custom fields from untrusted data or restrict access via WordPress authentication. Monitor logs for suspicious object injection attempts.

At a glance

What: PHP Object Injection in Gravity Forms plugin for WordPress via GFFormsModel::create_post() using unfiltered maybe_unserialize() instead of hardened GFCommon::maybe_unserialize(), affecting List-type custom fields.
Severity: CVSS 9.8 Critical. RCE possible if gadget chain available from other plugins or themes; guaranteed if custom field mapped to _wp_page_template on hosts with readable PEAR and register_argc_argv enabled.
Affected versions: Gravity Forms for WordPress, all versions up to and including 3.1.2.
Fix: Update Gravity Forms to version beyond 3.1.2 that implements hardened GFCommon::maybe_unserialize() method across all deserialization paths.
Status: Published on NVD 2026-10-30. Patch available. Social media awareness signals within last 24 hours. No confirmed public exploit (GitHub signal absent).
Action: Prioritize immediate Gravity Forms update. If not immediately feasible, disable List-type fields from untrusted data or restrict access via WordPress authentication. Monitor logs for suspicious object injection attempts.

Sources: NVD, CVE-2026-103039

← All articles