CVE advisoryCRITICAL
CVE-2026-103039
Gravity Forms PHP Object Injection Vulnerability
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A PHP Object Injection vulnerability exists in the Gravity Forms plugin for WordPress, potentially allowing unauthenticated attackers to inject a PHP object into post metadata. If a compatible gadget chain is present in other installed themes or plugins, or if the custom field is mapped to a specific WordPress meta key