Gravity Forms: PHP object injection in Post Custom Fields (CVE-2026-103039)

Gravity Forms versions 3.1.2 and earlier contain a PHP object injection vulnerability within the List input type of Post Custom Fields. The plugin incorrectly uses the native WordPress global maybe_unserialize() function instead of the secure GFCommon::maybe_unserialize() method. This allows unauthenticated attackers to supply serialized PHP objects. While the plugin contains no native gadget chains, exploitation is possible if other installed plugins, themes, or the WordPress core itself contain compatible gadgets. Notably, targeting the _wp_page_template meta key allows for RCE on environments where register_argc_argv is enabled and a PEAR installation is accessible.

Impact

Successful exploitation allows unauthenticated attackers to perform remote code execution if a suitable gadget chain exists in the WordPress environment.

Recommendation

• Update the Gravity Forms plugin to the latest version (patch released by Rocketgenius).
• Audit the WordPress site for plugins or themes that may contain dangerous deserialization gadget chains.
• Disable the register_argc_argv PHP configuration if not strictly required to mitigate the core-based gadget chain.
• Review custom field configurations to identify if they are mapped to sensitive meta keys like _wp_page_template.