{"id":"CVE-2026-97296","kind":"vulnerability","aliases":["CVE-2026-97296"],"related":[],"title":"Gravity Forms: untrusted data deserialization lets attackers inject objects","description":"Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.","summary":"Gravity Forms, a WordPress form plugin, deserializes untrusted data, which allows PHP object injection. An attacker who can reach the affected code path can potentially trigger unintended code behavior on the site.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gravity-forms","package","wordpress"],"not_affected_if":["updated-to-3.1.1"],"how_to_check":"- Check the installed Gravity Forms version in the WordPress admin plugins list or in the plugin's main file header.\n- unknown","fix":"- Update Gravity Forms to `3.1.1` or later.\n- unknown","status":"open","published_at":"2026-10-16T07:17:14+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:06:45+00:00","updated_at":"2026-10-25T03:06:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:06:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update Gravity Forms to `3.1.1` or later.\n- unknown","reach":"internet","title":"Gravity Forms: untrusted data deserialization lets attackers inject objects","impact":"high","summary":"Gravity Forms, a WordPress form plugin, deserializes untrusted data, which allows PHP object injection. An attacker who can reach the affected code path can potentially trigger unintended code behavior on the site.","category":"package","nicknames":[],"who_cares":["wordpress","gravity-forms"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may trigger PHP object injection on the site","analyst_note":"Check the Gravity Forms changelog and vendor advisory for the exact vulnerable code path, required privileges, and whether the NVD CVSS 8.1 score is confirmed.","how_to_check":"- Check the installed Gravity Forms version in the WordPress admin plugins list or in the plugin's main file header.\n- unknown","needs_analyst":true,"not_affected_if":["updated-to-3.1.1"],"who_is_affected":"Sites running Gravity Forms versions before `3.1.1` are affected, according to the NVD description. The sources do not say which configurations or features make a site exposed, so assume any site with the plugin installed before the update. Sites that have already updated to `3.1.1` or later are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000588,"input_tokens":3301,"output_tokens":516,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-97296':12A,15A '3.1.1':74C 'affect':41B,68C 'allow':31B,64C 'attack':7A,36B 'behavior':49B 'code':42B,48B 'cve':10A,13A 'data':4A,29B,56C 'deseri':5A,27B,53C 'form':2A,18B,22B,25B,62C,70C 'graviti':1A,17B,21B,61C,69C 'gravity-form':16B 'gravityform':63C 'inc':60C 'inject':8A,34B 'injection.this':66C 'issu':67C 'let':6A 'n/a':72C 'object':9A,33B,65C 'packag':19B 'path':43B 'php':32B 'plugin':26B 'potenti':45B 'reach':39B 'rocketgenius':59C 'site':52B 'trigger':46B 'unintend':47B 'untrust':3A,28B,55C 'vulner':57C 'wordpress':20B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running Gravity Forms versions before `3.1.1` are affected, according to the NVD description. The sources do not say which configurations or features make a site exposed, so assume any site with the plugin installed before the update. Sites that have already updated to `3.1.1` or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97296","severity":null,"published_at":"2026-10-16T07:17:14+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}