CVE-2026-97296: Deserialization of Untrusted Data in Rocketgenius, Inc Gravity Forms

This vulnerability in Gravity Forms involves deserialization of untrusted data, which can lead to object injection attacks. Such flaws occur when untrusted input is deserialized without proper validation, potentially allowing an attacker to execute arbitrary code or manipulate application state. The affected versions are all versions prior to 3.1.1. No known exploits are reported in the wild as of the publication date.

Successful exploitation could result in full compromise of the affected system, impacting confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and unchanged scope, with high impact on all three security properties.

No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted serialized data with affected versions or apply any recommended temporary mitigations from the vendor.