Gravity Forms: Unauthenticated PHP Object Injection via Post Custom Field
Summary
The Gravity Forms WordPress plugin up to and including 3.1.2 allows unauthenticated attackers to inject a PHP object into WordPress post meta. The attack uses a List-type form field mapped to a Post Custom Field with a content template enabled. The plugin itself contains no gadget chain, so the impact depends on other installed plugins or themes. If a gadget chain exists, or the field is mapped to _wp_page_template on a host with a readable PEAR install and register_argc_argv enabled, remote code execution is possible. CVSS 9.8 (critical).
Affected
- Gravity Forms plugin for WordPress, all versions up to and including 3.1.2
Fixed in
Unknown. No vendor fix was confirmed at the time of writing. Do not treat 3.1.1 or 3.1.2 as fixed for this issue.
Workaround
- Remove List-type fields mapped to Post Custom Fields from public forms, especially where a content template is enabled.
- Check hosts for a readable PEAR install and whether register_argc_argv is enabled. Disabling these reduces risk but is not a fix.
- Review post meta for unexpected serialized object data.
- Ask your WAF provider whether a virtual patch exists (not verified).
Exploitation
- VulDB reports that the attack can be launched remotely.
- No public exploit or proof of concept was found.
- An automated aggregator lists the CVE as not in CISA KEV. This is unverified; check the CISA catalog directly.
Our recommendation
- Identify all WordPress sites running Gravity Forms and record the exact version.
- Check forms for the affected configuration and remove it from public forms until a vendor fix is confirmed.
- Take a backup before making changes and monitor the vendor for a fix.
- Review post meta for suspicious serialized data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence advisory www.wordfence.com
- VulDB entry vuldb.com
- Strix CVE record www.strix.ai
- Gravity Forms documentation docs.gravityforms.com
- Patchstack: unauthenticated PHP object injection in Gravity Forms (2023, earlier issue) patchstack.com
- GitHub CVE aggregator issue github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:47.
Original description (NVD)
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.