CVE-2026-103039

The Gravity Forms plugin for WordPress (all versions up to and including 3.1.2 ) is vulnerable to PHP Object Injection . The root cause is that GFFormsModel::create_post() passes submitted values from a Post Custom Field (type: List ) to the unrestricted global maybe_unserialize() instead of the ...