Deserialization of untrusted data in the Gravity Forms plugin allows PHP object injection, enabling an attacker to execute arbitrary code on a WordPress site. The flaw permits remote execution if the application processes serialized data without proper validation, potentially compromising the entire site or the underlying server. It is a high‑severity vulnerability classified as CWE‑502.

The vulnerability affects the Gravity Forms plugin from Rocketgenius, Inc., used within WordPress installations. Any instance running a version older than 3.1.1 is susceptible. Upgrading to 3.1.1 or later removes the flaw.

The CVSS score of 8.1 indicates a high impact risk, and the EPSS score of <1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote attacker submitting crafted serialized payloads through form fields or administrative interfaces, which the plugin deserializes without validation. This could result in remote code execution or privilege escalation on the hosting environment. Administrators should act promptly.