CVE-2026-97296: WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Gravity Forms pluginto a version that resolves this vulnerability.Fixed in 3.1.1
Event History
Frequently Asked Questions
Which deployments are affected?
Gravity Forms versions earlier than 3.1.1 are affected. The available information does not identify any configuration prerequisites or exclusions.
Does an attacker need an account or user interaction to exploit this issue?
No privileges and no user interaction are required according to the supplied CVSS vector. Exploitation is network-accessible, although attack complexity is rated high.
What is the potential impact if exploitation succeeds?
The issue is rated high severity with high impacts to confidentiality, integrity, and availability. It may allow PHP object injection through deserialization of untrusted data.
What is the remediation?
Update Gravity Forms to version 3.1.1 or later. No alternative mitigation is provided in the available data.