{"id":"CVE-2026-103039","kind":"vulnerability","aliases":["CVE-2026-103039"],"related":[],"title":"Gravity Forms: unauthenticated PHP object injection through post custom fields","description":"The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution.","summary":"Gravity Forms up to and including 3.1.2 passes a submitted post custom field value to WordPress's unrestricted maybe_unserialize(), letting an unauthenticated attacker inject a PHP object into post meta. The plugin has no gadget chain of its own, but a gadget in another plugin or theme, or WordPress core via the _wp_page_template meta key on hosts with a readable PEAR install and register_argc_argv enabled, could allow remote code execution.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gravity-forms","package","php","self-hosted","wordpress"],"not_affected_if":["managed-hosting","no-post-custom-field-list","plugin-version-above-3.1.2"],"how_to_check":"- Check whether the Gravity Forms plugin is installed and its version (`3.1.2` or earlier is affected per the description)\n- Check whether a Post Custom Field of input type List with a content template is enabled in any form","fix":"- Gravity Forms: move to a version later than `3.1.2` (the fixed version is not stated in the sources)","status":"open","published_at":"2026-10-30T07:16:30+00:00","first_seen_at":"2026-10-30T07:29:00+00:00","triaged_at":"2026-10-30T07:30:04+00:00","updated_at":"2026-10-30T07:30:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T07:30:04Z","model":"claude-haiku-5-5","output":{"fix":"- Gravity Forms: move to a version later than `3.1.2` (the fixed version is not stated in the sources)","reach":"internet","title":"Gravity Forms: unauthenticated PHP object injection through post custom fields","impact":"high","summary":"Gravity Forms up to and including 3.1.2 passes a submitted post custom field value to WordPress's unrestricted maybe_unserialize(), letting an unauthenticated attacker inject a PHP object into post meta. The plugin has no gadget chain of its own, but a gadget in another plugin or theme, or WordPress core via the _wp_page_template meta key on hosts with a readable PEAR install and register_argc_argv enabled, could allow remote code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","gravity-forms","self-hosted","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker injects PHP objects; code execution possible via gadget chain","analyst_note":"Confirm the fixed Gravity Forms version and whether the NVD record's CVE id and version range are accurate; the sources do not state a fix.","how_to_check":"- Check whether the Gravity Forms plugin is installed and its version (`3.1.2` or earlier is affected per the description)\n- Check whether a Post Custom Field of input type List with a content template is enabled in any form\n- unknown whether PEAR and register_argc_argv are relevant beyond the description","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-version-above-3.1.2","no-post-custom-field-list","managed-hosting"],"who_is_affected":"Sites running the Gravity Forms WordPress plugin version 3.1.2 or earlier that use the Post Custom Field of input type List with a content template enabled. Exposure to code execution depends on a gadget chain in another plugin or theme, or on WordPress core via the _wp_page_template key with PEAR installed and register_argc_argv enabled; sites without these can still face data manipulation through injected post meta, and sites on a later plugin version are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000829,"input_tokens":4435,"output_tokens":770,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-103039':13A,16A '-2026':12A,15A '3.1.1':162C '3.1.2':32B,120C 'accept':262C 'action':235C 'add':160C 'addit':224C 'allow':97B,165C,230C 'anoth':70B 'argc':93B,286C 'argv':94B,287C 'attack':49B,194C,232C,273C 'attacker-control':272C 'call':186C 'chain':62B,208C,219C,259C 'class':166C 'code':99B,239C,292C 'content':178C 'control':274C 'core':76B 'could':96B,229C 'creat':136C 'custom':9A,37B,124C,243C 'cve':11A,14A 'due':133C 'enabl':95B,180C,288C 'execut':100B,240C,293C 'fals':167C 'field':10A,38B,125C,175C,244C 'file':261C 'form':2A,19B,27B,103C 'gadget':61B,68B,207C,218C 'gfcommon':155C 'gfformsmodel':135C 'global':145C 'graviti':1A,18B,26B,102C 'gravity-form':17B 'harden':154C 'host':24B,85B,278C 'howev':215C 'includ':31B,119C 'inject':6A,50B,112C,196C,206C 'input':127C 'instal':90B,283C 'instanti':172C 'key':83B,254C 'let':46B 'list':130C 'make':189C 'map':246C 'mayb':44B,146C,156C 'meta':56B,82B,202C,253C 'non':264C 'non-scalar':263C 'object':5A,53B,111C,171C,199C,205C 'packag':20B 'page':80B,251C 'pass':33B,138C,164C 'path':275C 'pear':89B,282C 'perform':234C 'php':4A,21B,52B,110C,198C,204C 'plugin':58B,71B,104C,151C,213C,225C 'possibl':191C 'post':8A,36B,55B,123C,137C,201C 'precis':168C 'present':210C,221C 'prevent':170C 'protect':249C 'rather':148C 'reach':184C 'readabl':88B,281C 'regist':92B,285C 'remot':98B,238C,291C 'resolv':270C 'row':183C 'scalar':265C 'self':23B 'self-host':22B 'submit':35B,140C,182C 'suppli':257C 'templat':81B,179C,252C 'theme':73B,227C,267C 'tostr':268C 'type':128C 'unauthent':3A,48B,193C 'unrestrict':43B,144C 'unseri':45B,147C,157C 'valid':260C 'valu':39B,141C 'verbatim':187C 'version':115C 'via':77B,121C,222C 'vulner':108C 'whose':126C 'wordpress':25B,41B,75B,106C,143C,255C 'wp':79B,250C,266C 'yield':290C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gravity Forms WordPress plugin version 3.1.2 or earlier that use the Post Custom Field of input type List with a content template enabled. Exposure to code execution depends on a gadget chain in another plugin or theme, or on WordPress core via the _wp_page_template key with PEAR installed and register_argc_argv enabled; sites without these can still face data manipulation through injected post meta, and sites on a later plugin version are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T07:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103039","severity":null,"published_at":"2026-10-30T07:16:30+00:00","modified_at":"2026-10-30T07:16:30+00:00","first_seen_at":"2026-10-30T07:29:00+00:00","fetched_at":"2026-10-30T07:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}