# CVE-2026-103039: Gravity Forms PHP Object Injection in Post Custom Field

Source: https://junglewise.ai/threats/cve-2026-103039-the-gravity-forms-plugin-for-wordpress-is-vulnerable-to-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-103039 · Severity: critical · CVSS 9.8 · Published 2026-10-30

Gravity Forms, a popular WordPress form-building plugin, contains a PHP Object Injection vulnerability in its List-type custom field that allows unauthenticated attackers to inject malicious serialized objects into the database. If a gadget chain is available through another plugin or theme, attackers could execute arbitrary code on the server. WordPress itself provides such a gadget chain in certain configurations, potentially enabling remote code execution without authentication.

Technologies: [Rocketgenius Gravity Forms](https://junglewise.ai/threats/technologies/gravity-forms). Vendors: [Rocketgenius](https://junglewise.ai/threats/vendors/rocketgenius).

## Quick answers

**Is CVE-2026-103039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103039 being exploited in the wild.

**How severe is CVE-2026-103039?** Critical severity, with a CVSS score of 9.8, published 30 October 2026.

**Which products and versions are affected?** Rocketgenius Gravity Forms up to and including 3.1.2.

**Is there a fix for CVE-2026-103039?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103039 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103039?** Check whether you run Rocketgenius Gravity Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in GFFormsModel::create_post(), which passes user-submitted values to WordPress's unrestricted maybe_unserialize() function instead of the plugin's hardened variant that prevents object instantiation. When a Post Custom Field of type List has a content template enabled, the submitted data is passed verbatim to the vulnerable function, allowing PHP object injection. Remote code execution is possible if a suitable gadget chain exists in other plugins/themes, or via WordPress's built-in WP_Theme::__toString() chain when the field is mapped to the protected _wp_page_template meta key and certain server conditions are met.

## Affected products

- Rocketgenius Gravity Forms up to and including 3.1.2

## Timeline

- 2026-10-30: disclosed

## References

- [https://docs.gravityforms.com/](https://docs.gravityforms.com/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/ec1fba15-81e5-42e3-9154-1978c3f81b26?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/ec1fba15-81e5-42e3-9154-1978c3f81b26?source=cve)

## Related threats

- [Gravity Forms plugin Stored Cross-Site Scripting in List Field](https://junglewise.ai/threats/cve-2026-97645-the-gravity-forms-plugin-for-wordpress-is-vulnerable-to-stored)
- [Gravity Forms plugin stored cross-site scripting in field values](https://junglewise.ai/threats/cve-2026-90437-the-gravity-forms-plugin-for-wordpress-is-vulnerable-to-stored)
- [Gravity Forms PHP object injection vulnerability](https://junglewise.ai/threats/cve-2026-97296-deserialization-of-untrusted-data-vulnerability-in-rocketgenius)
- [Gravity Forms arbitrary file upload via multi-file chunk state](https://junglewise.ai/threats/cve-2026-19513-gravity-forms-arbitrary-file-upload-via-multi-file-chunk-state)
- [Gravity Forms Directory Traversal in gform_uploaded_files parameter](https://junglewise.ai/threats/cve-2026-12997-gravity-forms-directory-traversal-in-gform-uploaded-files)