Skip to content
Threat Feed
Subscribe

Vendor

Rocketgenius

2 briefs RSS
critical advisory

Gravity Forms: PHP object injection in Post Custom Fields (CVE-2026-103039)

Gravity Forms for WordPress versions up to and including 3.1.2 is vulnerable to unauthenticated PHP object injection via Post Custom Fields, which can lead to remote code execution when combined with specific gadget chains.

PoC Gravity Forms wordpress deserialization rce
1t 1c updated
critical advisory

Unauthenticated Arbitrary File Upload in Gravity Forms

The Gravity Forms WordPress plugin (<= 3.1.0.4) is susceptible to unauthenticated remote code execution due to a validation flaw in the upload_file function allowing hidden file upload fields to bypass extension checks.

PoC Gravity Forms web-application wordpress arbitrary-file-upload rce
1r 2t 1c updated