CVE-2026-97296
8.1HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-502
Impact
Remote unauthenticated attackers can execute arbitrary code or compromise the application via PHP Object Injection. They need network access to submit maliciously serialized payloads to Gravity Forms endpoints.
Root cause
Insecure deserialization of user-supplied data allows attackers to inject PHP objects directly into the runtime environment.
Affected systems
Rocketgenius Gravity Forms versions prior to 3.1.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade the Gravity Forms WordPress plugin to version 3.1.1 or later. If patching immediately is not possible, disable the plugin or block requests containing serialized PHP objects at the web application firewall.
$ wp plugin update gravityforms --version=3.1.1AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.