The premium WordPress plugin ‘Gravity Forms,’ currently used by over 930,000 websites, is vulnerable to unauthenticated PHP Object Injection.

Gravity Forms is a custom form builder website owners use for creating payment, registration, file upload, or any other form required for visitor-site interactions or transactions.On its website, Gravity Forms claims it is used by a wide variety of large companies, including Airbnb, ESPN, Nike, NASA, PennState, and Unicef.The vulnerability, which is tracked as CVE-2023-28782, impacts all plugin versions from 2.73 and below.
The flaw was discovered by PatchStack on March 27, 2023, and fixed by the vendor with the release of version 2.7.4, which was made available on April 11, 2023.Website administrators using Gravity Forms are advised to apply the available security update as soon as possible.The issue arises from that lack of user-supplied input checks for the ‘maybe_unserialize’ function and can be triggered by submitting data to a form created with Gravity Forms.
“Since PHP allows object serialization, an unauthenticated user could pass ad-hoc serialized strings to a vulnerable unserialize call, resulting in an arbitrary PHP object(s) injection into the application scope,” warns PatchStack in the report.”Note that this vulnerability could be triggered on a default installation or configuration of the Gravity Forms plugin and only needs a created form that contains a list field.”

Despite the potential severity of CVE-2023-28782, PatchStack’s analysts could not find a significant POP (property-oriented programming) chain in the vulnerable plugin, somewhat mitigating the risk.However, the risk remains severe if the same site uses other plugins or themes that contain a POP chain, which isn’t uncommon considering the wide range of available WordPress plugins and themes and the varying levels of code quality and security awareness among developers.