A critical (CVSS 9.8) PHP Object Injection flaw in the Gravity Forms WordPress plugin, through version 3.1.2, lets unauthenticated attackers inject serialized PHP objects into post meta, and under specific conditions this can lead to remote code execution.
What Is It
CVE-2026-103039 is a deserialization of untrusted data weakness (CWE-502) in Gravity Forms. It is triggered through a Post Custom Field whose input type is List. The plugin's GFFormsModel::create_post() sends the submitted value to WordPress' unrestricted global maybe_unserialize(). It does not use the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false specifically to block object instantiation. When the field has a content template enabled, the submitted row reaches that call verbatim.
No known gadget chain is present in the plugin itself. A chain supplied by another plugin or theme could let an attacker perform actions such as remote code execution. The advisory also describes a possible path through WordPress core when the custom field is mapped to the protected _wp_page_template meta key:
- validate_file() accepts non-scalar input
- WP_Theme::__toString() then resolves a path the attacker controls
- According to the advisory, on hosts with a readable PEAR install and register_argc_argv enabled, this chain may allow remote code execution. Whether it works in practice is likely to depend on the specific host and WordPress configuration, and no public proof-of-concept was referenced in the sources reviewed for this brief.
Why It Matters
Wordfence rates this flaw CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is network-reachable, has low attack complexity, and needs no privileges or user interaction. Confidentiality, integrity and availability impact are all rated high.
Exploitation requires a vulnerable form configuration: a List-type Post Custom Field. The path that reaches the unsafe call verbatim also requires a content template. Where a usable gadget chain exists, an anonymous form submission could be enough to compromise the site.
The CISA KEV entry supplied for this brief is empty. KEV does not currently confirm active exploitation. NVD lists the record's status as "Received" (published 2026-10-30).
What's Vulnerable
- Vendor/Product: Gravity Forms, the Gravity Forms plugin for WordPress
- Affected versions: all versions up to and including 3.1.2
- Required configuration: a Post Custom Field with input type List. The submitted value reaches the unsafe call verbatim when a content template is enabled.
- Conditions for potential RCE via WordPress core (per the advisory): the field is mapped to
_wp_page_template, and the host has a readable PEAR install andregister_argc_argvenabled
Patch Status
The supplied NVD record lists versions through 3.1.2 as affected but does not name a fixed release. No CISA required action exists because the KEV entry is empty. Sites running Gravity Forms 3.1.2 or earlier should check the vendor and Wordfence advisories below for a patched version and update as soon as one is confirmed. In the meantime, administrators should review forms for Post Custom Fields of type List, especially any with content templates enabled or mappings to _wp_page_template.