EUVD-2026-102810
GHSA-vr5m-98rv-h768
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vulnerable Gravity Forms endpoint
-
DeliverySubmit crafted serialized payload
-
ExploitTrigger unsafe unserialize()
-
ExecutionInstantiate malicious object via gadget chain
-
ImpactAchieve code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the vulnerable Gravity Forms plugin (any version before 3.1.1) installed on a WordPress site, and an attacker-reachable code path that deserializes attacker-supplied input via PHP unserialize(). The decisive limiting factor, reflected in CVSS AC:H, is that object injection only yields meaningful impact when a usable POP gadget chain is present in the running PHP environment (the plugin, WordPress core, or another installed plugin/theme); without such a chain, injection may not escalate to code execution or data compromise. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the specific triggering endpoint or form feature is not named in the description and should be confirmed against the Patchstack advisory and vendor changelog for 3.1.1. |
| Impact | This is a CWE-502 PHP Object Injection flaw in the Gravity Forms WordPress plugin (versions before 3.1.1), rated CVSS 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - network-reachable, no privileges or user interaction required, but with high attack complexity and full confidentiality/integrity/availability impact. The high complexity (AC:H) is the dominant mitigating signal: PHP object injection is only exploitable when a usable POP (property-oriented programming) gadget chain is reachable in the loaded codebase (the plugin, WordPress core, or another installed plugin/theme), which is why severity is High rather than Critical despite the unauthenticated network vector. EPSS exploitation probability is NOT provided in the input, this CVE is NOT listed in CISA KEV, and no public POC is referenced - so there is no evidence of active exploitation or weaponization, and exploitation should be treated as hypothetical-but-credible rather than imminent. The single source is a Patchstack advisory (audit@patchstack.com), which is a reputable WordPress vulnerability database, lending reasonable confidence to the existence and version boundary of the flaw. Given Gravity Forms' large installed base, this is a genuine patch priority for exposed sites, but the AC:H requirement and absence of KEV/POC signals place it below actively-exploited unauthenticated RCE in triage order. |
| Exploit ScenarioDerived | An unauthenticated attacker submits crafted serialized data to a Gravity Forms endpoint that passes it to an unsafe PHP unserialize() call, instantiating attacker-controlled objects. If a suitable gadget chain exists in WordPress core, Gravity Forms, or another installed plugin, the injected object's magic methods can be abused to achieve file operations, SQL interaction, or remote code execution. No public POC is referenced in the available data, and the high CVSS attack complexity reflects the dependence on a reachable gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
PHP object injection in the Gravity Forms WordPress plugin (all versions before 3.1.1) allows unauthenticated, network-reachable attackers to feed crafted serialized data into a PHP unserialize() call, which can lead to object injection and, if a suitable gadget chain is present in the running PHP stack, to full compromise of confidentiality, integrity, and availability. The flaw is rated CVSS 8.1 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no credentials and no user interaction are needed, but the high attack-complexity component reflects that exploitation depends on a usable POP gadget chain existing in the plugin, WordPress core, or another installed plugin or theme. At time of analysis there is no public exploit identified (no CISA KEV listing and no published proof-of-concept in the supplied intelligence), and the vulnerability was reported through Patchstack to the vendor, with version 3.1.1 identified as the fixed release.
RemediationAI
Update Gravity Forms to version 3.1.1 or later, the release identified in the Patchstack advisory as resolving this PHP object injection issue; the update can be applied from the WordPress admin Plugins screen or via WP-CLI with 'wp plugin update gravityforms', after which the installed version should be verified against the Gravity Forms changelog and the advisory at https://patchstack.com/database/wordpress/plugin/gravityforms/vulnerability/wordpress-gravity-forms-plugin-3-1-1-php-object-injection-vulnerability?_s_id=cve - this fix is classified as a vendor-released patch at the 3.1.1 version level. If updating immediately is not possible, the most reliable compensating control is to deactivate the Gravity Forms plugin entirely, which removes the vulnerable deserialization path at the cost of losing all form functionality on the site. Where the plugin must remain active, reducing the attack surface is the priority: audit and remove unused plugins and themes to shrink the set of available gadget chains (exploitation is materially harder without a usable chain, given the AC:H rating), restrict or block access to any endpoints that accept serialized input where this can be identified from the form configuration, and deploy WAF rules that flag serialized object payloads such as 'O:' followed by a class-name length, accepting that such signatures can produce false positives on legitimate serialized data and may be bypassed with encoding tricks. Because no authentication or user interaction is required, IP allow-listing of administrative or form-submission endpoints is only a partial mitigation, and no specific fixed version below 3.1.1 should be assumed to be safe.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, Deserialization of Untrusted Data, specifically PHP object injection. Gravity Forms passes attacker-influenced input into PHP's unserialize() (or an equivalent deserialization path), allowing an attacker to instantiate arbitrary objects if the serialized payload names a class that is autoloadable in the running WordPress environment. Because deserialization triggers magic methods such as __wakeup(), __destruct(), and __toString(), an attacker who identifies a valid POP (property-oriented programming) gadget chain can pivot from simple object instantiation to file operations, data exfiltration, or code execution. The dependency on a pre-existing gadget chain is exactly why the assessed vector carries AC:H despite PR:N and UI:N. No CPE strings were supplied with this record, so the affected technology stack is identified from the description and the Patchstack reference rather than from formal CPE enumeration: it is the Rocketgenius Gravity Forms plugin for WordPress, a widely deployed commercial form-building extension that runs in the same PHP process as WordPress core and any other active plugins and themes. Practical exposure therefore scales with the number of other installed components on the site, since each one can contribute additional gadget chains.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization (AV:N/PR:N/UI:N) but AC:H because exploitation depends on a reachable POP gadget chain; object injection can yield full C/I/A impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
Executive ViewAI
The Gravity Forms WordPress plugin (versions before 3.1.1) contains a high-severity object injection vulnerability that could allow unauthenticated, network-reachable attackers to fully compromise affected sites if a usable gadget chain exists. Although no public exploit has been identified at time of analysis, the plugin's widespread use and the potential for complete loss of confidentiality, integrity, and availability make this a priority for security leadership.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB