Live › vulnerability › CVE-2026-97296
Go to dashboardGravity Forms, a WordPress form plugin, deserializes untrusted data, which allows PHP object injection. An attacker who can reach the affected code path can potentially trigger unintended code behavior on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Gravity Forms versions before 3.1.1 are affected, according to the NVD description. The sources do not say which configurations or features make a site exposed, so assume any site with the plugin installed before the update. Sites that have already updated to or later are not affected.
3.1.1No product ranges from the sources yet.
3.1.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-97296")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.