Gravity Forms: PHP Object Injection (CVE-2026-103039)
A PHP Object Injection vulnerability (CVSS 9.8) was reported in the Gravity Forms plugin for WordPress. GFFormsModel::create_post() passes a List field value to the unrestricted global maybe_unserialize(). An unauthenticated attacker can inject a PHP object into post meta.
Checked in Shield: no
Who is affected
All Gravity Forms versions up to and including 3.1.2. Condition: a Post Custom Field with the List input type and a content template enabled. Remote code execution requires a gadget chain from another plugin or theme.
How to check
Check the Gravity Forms version under Plugins in WordPress. Review whether any forms use a List-type Post Custom Field with a content template enabled.
How to fix
The source does not name a fixed version. Watch for a plugin update and install the patch once released. Until then, consider reviewing forms that use such fields.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Exploitation status and the fixed version number are not disclosed yet. Source: NVD, CVE-2026-103039.
