CVE-2026-103039

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create post() passing the submitted value to WordPress' unrestricted global maybe unserialize() rather than the plugin's own hardened GFCommon::maybe unserialize(), which was added in 3.1.1 and passes allowed classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected wp page template meta key, WordPress itself supplies the chain: validate file() accepts non-scalars, WP Theme:: toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register argc argv enabled this yields remote code execution.