Security notice
WordPress site using Gravity Forms? A flaw rated 9.8 needs no login. Update to 3.1.3 or later.
Gravity Forms is a paid WordPress plugin for building forms, and Censys counts about 83,800 web properties running it. On October 29, 2026, security firm Patchstack published a critical flaw in it, and the CVE record, assigned by Wordfence and published October 30, rates it 9.8 out of 10. In versions up to and including 3.1.2, a stranger with no login can use a public form to plant booby-trapped data in your site's database. It applies only to forms that create WordPress posts and use one particular kind of custom field, and whether it leads to a full takeover depends on your other plugins and themes and on your host's settings. Version 3.1.3 fixes it and was released October 1, so a site that has updated since then is covered. Patchstack labels the flaw as exploited but names no source. Censys found no confirmed exploitation as of October 30, and CISA does not list it. We call it reported exploited, not confirmed. If your site runs Gravity Forms, update to 3.1.3 or later today.
What happened
- The flaw. The CVE record describes an "unauthenticated PHP Object Injection." In plain words, when a visitor submits one kind of public form, the plugin can store what they typed as a live data object instead of plain text, and no account is needed. The CVE record says the plugin already had a safer way of handling this data from version 3.1.1, but it was not used on this path. We are leaving out the technical details. (CVE record)
- Which sites are exposed. According to the CVE record, only forms that create WordPress posts and include a custom field of the "List" type, with a content template turned on. Censys points out that neither setting can be seen from outside the site. Many Gravity Forms sites will have no such form, but you cannot tell from your home page, so check or update. (CVE record, Censys)
- How serious. The CVE record rates it CVSS 9.8, which is 9.8 out of 10 and critical: reachable over the internet, low complexity, no account and no visitor interaction needed. The CVE record and Censys both say the plugin has no way of its own to run code from this. Whether it becomes a takeover of the server depends on other plugins or themes on the site, or on certain host settings. Censys says it cannot see those from outside. So 9.8 is the worst case. (CVE record, Censys)
- Affected and fixed versions. Gravity Forms 3.1.2 and earlier. Patchstack lists 3.1.3 as the patched version. The affected range ends at 3.1.2, so later releases, including 3.2.0 (October 20) and 3.2.1 (October 28), are outside it. WPDeeply says the 3.2 line contains the fix. (Patchstack, CVE record, Gravity Forms changelog, WPDeeply)
- The dates. The CVE record says the vendor was notified on September 30. The Gravity Forms changelog dates 3.1.3 October 1. Patchstack published its entry on October 29, and Wordfence's disclosure the same day. The CVE record followed on October 30. So the fix came out four weeks before the public details, and a site that updated since October 1 already has it. (CVE record, Gravity Forms changelog, Patchstack)
- The changelog does not name it. The 3.1.3 entry says only "Added security enhancements." The same line appears on 3.1.1, 3.1.2, 3.2.0 and 3.2.1. It does not name this flaw or the CVE number, so we rely on Patchstack and the CVE record for the statement that 3.1.3 fixes it. Censys makes the same point. (Gravity Forms changelog, Censys)
- Reported exploited, not confirmed. Patchstack's entry carries a "Known to be exploited" label, but it names no source, victims or dates. Censys says there was no confirmed exploitation as of October 30, and CISA's assessment attached to the CVE record rates exploitation as "none." CISA KEV does not list it in its version dated October 30, 2026, and a Patchstack label is not a CISA listing. We could not confirm either side, so treat it as possibly under attack. (Patchstack, Censys, CVE record, PowerSEC)
- A claimed proof of concept. PowerSEC reports a public code repository created on October 31 that claims to be a proof of concept. It says it did not run it or treat it as proof of working attacks. We have not tested it and do not link to it. (PowerSEC)
- Patchstack customers. Patchstack says it has issued a mitigation rule for its own customers. That is not a replacement for updating. (Patchstack)
Who should worry
This is about WordPress websites that use the Gravity Forms plugin. If you are not sure whether your site uses it, ask your web developer or agency. Ask about this if any of these are true:
- Your WordPress site uses Gravity Forms and is on version 3.1.2 or earlier.
- One of your forms lets visitors submit posts, listings, reviews or other content that your site publishes or saves as a post.
- Automatic plugin updates are off on your site, or you are not sure they are on.
- An agency or developer built your forms and you do not know which plugin runs them.
- You run a web agency or host and look after WordPress sites for clients.
If your site does not use Gravity Forms, this notice does not apply to you.
What to do now
Do these today.
- Check if you have it. In your WordPress dashboard, open Plugins, then Installed Plugins, and look for "Gravity Forms." Note the version number. If it says 3.1.3 or higher, you have the fix.
- Update. Update Gravity Forms to 3.1.3 or later. The newest release on the Gravity Forms changelog is 3.2.1. Take a backup first, and test your forms afterwards. (Patchstack, Gravity Forms changelog)
- Clear your caches. After the update, ask your developer or host to clear page, object, CDN and host caches so your public forms use the updated code. This is WPDeeply's advice. (WPDeeply)
- If you cannot update today, ask your developer whether to switch off any form that creates posts, and especially any with a "List" custom field, until you can. This is WPDeeply's advice, not the plugin maker's. Patchstack's own advice is to update, or ask your host or developer for help. (WPDeeply, Patchstack)
- Check for a break-in. Updating closes the hole but does not remove anything left behind before it. Ask your developer to review recent submissions and the posts your forms created for anything unexpected, and to look for administrator accounts you do not recognize, plugins you did not install and PHP files you did not put there. WPDeeply gives the same advice. (WPDeeply)
What to send your developer, agency or host
Gravity Forms 3.1.2 and earlier has an unauthenticated PHP object injection flaw, CVE-2026-103039 (CVSS 9.8, assigned by Wordfence, published October 30, 2026). It is fixed in 3.1.3, released October 1. It is reachable through forms that create posts and use a List-type custom field with a content template. Patchstack labels it exploited but names no source; Censys found no confirmed exploitation as of October 30; CISA does not list it. Please tell us whether our site runs Gravity Forms and which version. If it is 3.1.2 or earlier, please update to 3.1.3 or later today, clear caches, and check whether any of our forms create posts with a List-type custom field. Please also review recent submissions and created posts, and check for unfamiliar administrators, plugins or PHP files, and tell us what you find. Sources: the CVE record, Patchstack, Censys, the Gravity Forms changelog.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It means a critical flaw has been published and a fix is out. Attacks are reported by one source and not confirmed by another.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which plugins your site runs, which versions they are on or how your forms are set up, so if our scan does not warn you about this plugin, that does not mean you are safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
I updated in October. Am I covered?
If your plugin shows 3.1.3 or higher, you have the fix. Plugin updates can be turned off or fail, so check the version.
I have no form that creates posts. Am I safe?
The CVE record says the flaw needs a form that creates posts. We cannot check your forms, so we cannot confirm that for your site. Update anyway.
Is it being exploited?
Reported, not confirmed. Patchstack labels it exploited and names no source. Censys found no confirmed exploitation as of October 30, and CISA does not list it. (Patchstack, Censys)
Where can I follow official updates?
The Gravity Forms changelog, Patchstack and Censys. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- CVE Program: CVE-2026-103039, published October 30, 2026 by Wordfence, checked November 1, 2026
- Patchstack: WordPress Gravity Forms Plugin <= 3.1.2 is vulnerable to a high priority Deserialization of untrusted data, October 29, 2026, checked November 1, 2026
- Censys: Oct 30 Advisory: Gravity Forms PHP Object Injection [CVE-2026-103039], October 30, 2026, checked November 1, 2026
- Gravity Forms: Gravity Forms changelog, versions 3.1.3 to 3.2.1, checked November 1, 2026
- WPDeeply: Gravity Forms 3.1.2 object injection, CVE-2026-103039, October 31, 2026, checked November 1, 2026
- PowerSEC: Gravity Forms vulnerability: CVE-2026-103039, October 31, 2026, checked November 1, 2026
- CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 30, 2026, checked November 1, 2026