PatchTheCVECVE-2026-103039: The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includ
CVE-2026-103039 is a critical-severity flaw (CVSS 9.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent obj
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | n/a |
| CISA exploited list | No |
| Weakness | CWE-502 |
| Published | 2026-10-30 |
| Last modified | 2026-10-30 |
Last updated 2026-10-30 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- Vulners Bulletins: CVE-2026-103039 2026-10-30
- Vulners Bulletins: CVE-2026-103039 2026-10-30
- Vulners Bulletins: CVE-2026-103039 Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field 2026-10-30
- VulDB Recent Entries: CVE-2026-103039 | Gravity Forms Plugin up to 3.1.2 on WordPress Post Custom Field create_post deserialization 2026-10-30
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-103039?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-103039 being exploited?
CVE-2026-103039 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-103039 affect?
CVE-2026-103039 affects affected software. Severity is critical (CVSS 9.8). The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted valu
How urgent is CVE-2026-103039?
Priority 39/100. Critical severity; Remotely exploitable, no login, no user action
Software pages
WordPress vulnerabilities · PHP vulnerabilities