This vulnerability in the PDF for Gravity Forms + Drag And Drop Template Builder plugin is due to unsafe deserialization of untrusted data, which allows object injection. The affected versions are from an unspecified initial version through 6.5.0. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

Successful exploitation could allow an attacker to inject malicious objects via deserialization, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The attack requires network access and low privileges but no user interaction. This could result in unauthorized data access, modification, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the affected plugin to untrusted networks or users. Monitor for vendor updates and apply patches promptly once released.