Gravity Forms: PHP object injection via deserialization of untrusted data
Summary
Gravity Forms, a WordPress form plugin, contains a deserialization flaw (CWE-502) that allows PHP object injection. According to the Patchstack record, an unauthenticated attacker can send crafted input over the network to manipulate how the site processes data and run harmful actions on the server. Actual impact depends on gadget chains available in installed plugins, themes or PHP.
Affected
- Gravity Forms versions before 3.1.1 (lower bound unknown; the CNA record says "from n/a")
- Some sources state up to 3.1.0 only; treat all builds before 3.1.1 as affected
- A separate issue, CVE-2026-103039, reportedly affects up to and including 3.1.2
Fixed in
- Gravity Forms 3.1.1 (per CNA record and Patchstack)
- Install the latest available Gravity Forms release, not only 3.1.1, because CVE-2026-103039 reportedly bypasses the 3.1.1 hardening
- Fix version for CVE-2026-103039: unverified (one secondary source names 3.1.3)
Workaround
- Unknown. No vendor-approved workaround is documented.
- Interim measure: restrict access to form submission endpoints via a web application firewall until patched.
Exploitation
- No public proof of concept found.
- No evidence of exploitation in the wild; CISA SSVC lists exploitation as none and automatable as no.
- Patchstack states the vulnerability is expected to become exploited and is used in mass-exploit campaigns.
- EPSS: 0.00257.
Our recommendation
- Update all WordPress sites with Gravity Forms to the latest available release, at least 3.1.1.
- Check for internet-facing WordPress sites with Gravity Forms installed and prioritise them.
- Until patched, apply WAF rules that block malicious requests to form endpoints, if available.
- Review logs for unusual requests to form submission endpoints.
- Track CVE-2026-103039 and verify the fix version with the vendor.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Gravity Forms 3.1.1 release blog www.gravityforms.com
- Ionix threat center www.ionix.io
- VulDB CVE-2026-97296 vuldb.com
- VulDB vulnerability 421184 vuldb.com
- Tenable CVE-2026-97296 www.tenable.com
- WPScan Gravity Forms wpscan.com
- VulDB vulnerability 428960 (CVE-2026-103039) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:54.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.