CVE-2026-103039
CRITICAL · 9.8 EPSS 0.5%Real vuln, patched, but no confirmed exploitation; chatter is vendor alerts + FUD conflating likelihood.
What: PHP Object Injection in Gravity Forms WordPress plugin (all versions ≤3.1.2) via List-type Post Custom Fields; unauthenticated remote code execution possible if gadget chain present in WordPress/themes. CVSS 9.8 CRITICAL.
Why it matters: Published 24 hours ago; high-impact vuln requiring chain to adjacent code (WordPress itself supplies one under specific config). No KEV listing yet, no confirmed PoC or in-the-wild exploitation reported. Social chatter is rapid advisory recycling and scanning announcements (Censys: 83,800 Gravity Forms instances). Patch released (3.1.3+) but adoption unclear.
Where it's seen: Vulnerability aggregators and threat feeds amplifying NVD entry; scanning vendors offering queries; one post conflates risk ("dump wp-config") with actual preconditions (requires PEAR + register_argc_argv). No defender triage reports or PoC code linked.
RISK: HIGH — Unauthenticated object injection into 80K+ sites; RCE chain conditional on secondary factors.
Description
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High