Gravity Forms CVE-2026-103039

Exploitation requires the target site to have a Gravity Forms form containing a Post Custom Field whose input type is List with a content template enabled, so that the submitted row value reaches the unrestricted maybe_unserialize() verbatim - this is a non-default form configuration, not present on a stock install. Object injection by itself produces no impact unless a PHP Object Injection gadget chain exists via an additional plugin or theme. The self-contained remote code execution path additionally requires the custom field to be mapped to the protected _wp_page_template meta key AND the host to have a readable PEAR installation AND register_argc_argv enabled. Limiting factors: no authentication or user interaction is needed to reach the injection, but the field configuration and, for RCE, the host environment conditions substantially narrow the realistically exploitable population.

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H) frames this as a worst-case unauthenticated remote code execution, and the vuln.today Decision label is act_now with the report sourced from Wordfence, so this should be treated as a priority. However, the signals must be weighed against the mechanism the evidence actually describes: object injection alone has no impact because no PHP Object Injection gadget chain is present in the plugin itself, and full RCE is contingent on either a gadget chain supplied by another plugin/theme or a specific chain (custom field mapped to _wp_page_template, plus a readable PEAR install and register_argc_argv enabled). These are conditions beyond the attacker's control, which argues the realistic complexity is higher than the AC:L in the supplied vector. No KEV status, EPSS probability, or confirmed working exploit is present in the input, so exploitation is not confirmed in the wild; the references are a Wordfence advisory and vendor docs, not a verified PoC. Net: a genuinely serious, unauthenticated-reachable flaw on sites whose forms use the affected configuration, but the headline 9.8 assumes the worst-case RCE chain that depends on non-default form configuration and host environment, so blanket risk across all installs is lower than the score implies. The act_now label still warrants prompt patching.

An unauthenticated attacker submits a Gravity Forms form that writes to a Post Custom Field of List input type with a content template enabled, embedding a serialized PHP object in a submitted row; GFFormsModel::create_post() passes it to WordPress' unrestricted maybe_unserialize(), instantiating the object into post meta. If the field is mapped to the protected _wp_page_template meta key on a host with a readable PEAR install and register_argc_argv enabled, WordPress' own WP_Theme::__toString()/validate_file() chain resolves an attacker-controlled path and yields remote code execution. No confirmed public exploit is identified in the provided data.