Critical Severity
CVE-2026-103039
Published: Nov 5, 2026
CVE-2026-103039: Gravity Forms <= 3.1.2 PHP object injection to RCE. PoC by NOXCRYPT (noxcrypt-x). gen_payload.php is not included.
# CVE-2026-103039 — Gravity Forms PHP Object Injection
**Unauthenticated PHP object injection leading to remote code execution (RCE)**
> **Author:** NØXCRYPT · [@noxcrypt-x](https://github.com/noxcrypt-x)
>
> **Disclaimer:** This repository is provided for security research and authorized testing only. Do not use it against systems you do not own or have explicit permission to test. The author is not responsible for any misuse.
>
> **Repository contents:** PoC script and documentation only. The optional PHP payload generator (`gen_payload.php`) is intentionally not included.
| | |
|---|---|
| Product | Gravity Forms (WordPress plugin) |
| Affected versions | All versions up to 3.1.2 |
| Fixed in | 3.1.3 |
| Class | CWE-502 — Deserialization of Untrusted Data |
| CVSS 3.1 | 9.8 Critical — `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| Identifiers | CVE-2026-103039 |
| Vector | Post Custom Field (List input type) with content template enabled |
---
## 1. Summary
`GFFormsModel::create_post()` passes the submitted value of a Post Custom Field (List input type, content template enabled) to WordPress' unrestricted global `maybe_unserialize()` instead of Gravity Forms' hardened `GFCommon::maybe_unserialize()`, which sets `allowed_classes => false`.
This allows an unauthenticated attacker to inject PHP objects into post meta. No gadget chain ships in the plugin itself. RCE requires one of the following:
- A POP chain provided by another plugin or theme installed on the target, or
- The `_wp_page_template` meta-key vector on a WordPress version where `validate_file()` accepts non-scalars (pre-fix), combined with a readable PEAR installation and `register_argc_argv` enabled.
---
## 2. Root Cause
Gravity Forms uses two different deserialization helpers:
- `GFCommon::maybe_unserialize()` — hardened, with `allowed_classes => false`
- WordPress global `maybe_unserialize()` — unrestricted
For the affected field type, the submitted value reaches the unrestricted helper. A s