CVE-2026-103039

Summary

The Gravity Forms WordPress plugin up to v3.1.2 suffers from PHP Object Injection via the List custom field when a content template is enabled, because GFFormsModel::create_post() uses WordPress' unsafe maybe_unserialize() instead of the plugin's hardened GFCommon::maybe_unserialize(), allowing unauthenticated attackers to inject arbitrary PHP objects into post meta.

Exploitability

Exploitation requires an attacker to submit a malicious serialized object via a List field with content template enabled on a vulnerable Gravity Forms installation; no authentication is needed, but successful remote code execution depends on the presence of additional gadget chains in WordPress or third-party plugins/themes.

Blast radius

If combined with a suitable gadget chain—such as WordPress' built-in WP_Theme chain when mapping to _wp_page_template—an unauthenticated attacker could achieve remote code execution on the server, fully compromising confidentiality, integrity, and availability.

Detection

Look for POST requests to WordPress endpoints (e.g., /wp-admin/admin-ajax.php or form submission endpoints) containing serialized data in custom field values—especially in fields named like 'input_XX' or 'field_XX'—that include the string 'O:' followed by a class name and parentheses, such as 'O:8:"stdClass":'. Monitor for unusual _wp_page_template meta updates via REST API or post meta endpoints.

Prioritized remediation

Upgrade to Gravity Forms version 3.1.3 or later, which ensures GFCommon::maybe_unserialize() is used with allowed_classes => false for List field inputs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.