Is CVE-2026-103039 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103039 being exploited in the wild.

How severe is CVE-2026-103039?

Critical severity, with a CVSS score of 9.8, published 30 October 2026.

Which products and versions are affected?

Rocketgenius Gravity Forms up to and including 3.1.2.

Is there a fix for CVE-2026-103039?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-103039 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-103039?

Check whether you run Rocketgenius Gravity Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103039: Gravity Forms PHP Object Injection in Post Custom Field

CVE-2026-103039 · Severity: critical · CVSS 9.8 · Published 2026-10-30

Gravity Forms, a popular WordPress form-building plugin, contains a PHP Object Injection vulnerability in its List-type custom field that allows unauthenticated attackers to inject malicious serialized objects into the database. If a gadget chain is available through another plugin or theme, attackers could execute arbitrary code on the server. WordPress itself provides such a gadget chain in certain configurations, potentially enabling remote code execution without authentication.

Technologies: Rocketgenius Gravity Forms. Vendors: Rocketgenius.

Quick answers

Is CVE-2026-103039 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103039 being exploited in the wild.
How severe is CVE-2026-103039?: Critical severity, with a CVSS score of 9.8, published 30 October 2026.
Which products and versions are affected?: Rocketgenius Gravity Forms up to and including 3.1.2.
Is there a fix for CVE-2026-103039?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103039 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-103039?: Check whether you run Rocketgenius Gravity Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in GFFormsModel::create_post(), which passes user-submitted values to WordPress's unrestricted maybe_unserialize() function instead of the plugin's hardened variant that prevents object instantiation. When a Post Custom Field of type List has a content template enabled, the submitted data is passed verbatim to the vulnerable function, allowing PHP object injection. Remote code execution is possible if a suitable gadget chain exists in other plugins/themes, or via WordPress's built-in WP_Theme::__toString() chain when the field is mapped to the protected _wp_page_template meta key and certain server conditions are met.

Affected products

Rocketgenius Gravity Forms up to and including 3.1.2

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.