Gravity Forms WordPress Plugin PHP Object Injection Vulnerability

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.1.2 via a Post Custom Field whose input type is List.

The flaw occurs because GFFormsModel::create_post() passes the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim.

This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution.

• Affected versions: all versions up to and including 3.1.2
• Condition: Post Custom Field with input type List and content template enabled
• Impact: PHP object injection into post meta; potential remote code execution if a gadget chain exists via another plugin or theme
• Additional chain: when mapped to _wp_page_template meta key, WordPress itself supplies the chain via validate_file() accepting non-scalars and WP_Theme::__toString() resolving an attacker-controlled path; on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution.