CVE-2026-103039: Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of 30 Oct 2026.

VulnCheck KEV lists it since 30 Oct 2026. It cites 1 public report, the first from 30 Oct 2026.

• patchstack.com

How likely is exploitation in the next 30 days?

0.5%

EPSS score, percentile 43.4 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

9.8 Critical

CVSS v3.1 base score, given by the CNA

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

• 3.1.2 and earlier

Versions by product

Source: CISA KEV 2026.10.30, as of 30 Oct 2026; VulnCheck KEV, as of 1 Nov 2026; FIRST EPSS, as of 31 Oct 2026; CVE List, as of 1 Nov 2026. About the data.

Description

Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution.

Source: CVE List, as of 1 Nov 2026. About the data.

What to do

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

This summary is based on the CVE record as of 1 Nov 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Source: CVE List, as of 1 Nov 2026. About the data.

Timeline