CVE-2026-97296 Rocketgenius, Inc CVE debrief

Who should care

Defenders responsible for WordPress installations using Gravity Forms versions prior to 3.1.1 should assess potential exposure and impact. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and plan for updates or mitigations.

Why it matters

CVE-2026-97296 is a Deserialization of Untrusted Data vulnerability in Gravity Forms plugin for WordPress, allowing Object Injection. Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems using Gravity Forms versions prior to 3.1.1.

• Potential Object Injection attacks may allow for arbitrary code execution
• Defenders must verify Gravity Forms version and update to 3.1.1 or later
• Exposure assessment is required for systems using Gravity Forms versions prior to 3.1.1

Technical summary

The Gravity Forms plugin for WordPress is vulnerable to Object Injection due to a Deserialization of Untrusted Data vulnerability. This issue affects Gravity Forms versions from n/a before 3.1.1. The vulnerability allows for potential Object Injection attacks, which may lead to arbitrary code execution. Defenders must verify Gravity Forms version and update to 3.1.1 or later if necessary.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems using Gravity Forms versions prior to 3.1.1.

Recommended defensive actions

• Verify Gravity Forms version and update to 3.1.1 or later if necessary
• Assess potential exposure and impact on systems using Gravity Forms versions prior to 3.1.1
• Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the full scope of affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.