$custom_field_value = maybe_unserialize( $submitted_value );

$custom_field_value = GFCommon::maybe_unserialize( $submitted_value );

---
title: Gravity Forms PHP Object Injection - POST Request with Serialized Payload
id: 8f4e2d91-6b3a-4c85-9e17-5f8a2b9c4d1e
status: experimental
description: Detects HTTP POST requests to WordPress containing serialized PHP object patterns indicative of CVE-2026-103039 exploitation attempts against Gravity Forms.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103039
  - https://www.gravityforms.com/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection:
    c-uri|contains:
      - '/wp-admin/admin-ajax.php'
      - '/index.php'
    cs-method: 'POST'
    c-uri-query|contains:
      - 'O:8:'
      - 'O:9:'
      - 'O:10:'
      - 'a:1:{'
      - 's:4:"'
  filter:
    c-uri-query|contains: 'action=gform_submit'
  condition: selection and not filter
falsepositives:
  - Legitimate Gravity Forms submissions with complex field data
  - Other WordPress plugins that use serialized data
level: high
---
title: PHP Process Spawning Command Shell - WordPress Context
id: 3c7a9f52-8d1e-4b96-a3c4-7e2f1d8b5a9c
status: experimental
description: Detects PHP processes spawning command shells or system utilities, commonly observed after successful PHP Object Injection exploitation in WordPress environments.
references:
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'php'
      - 'apache2'
      - 'httpd'
      - 'nginx'
      - 'php-fpm'
  selection_child:
    CommandLine|contains:
      - '/bin/sh'
      - '/bin/bash'
      - 'curl'
      - 'wget'
      - 'nc '
      - 'netcat'
      - 'python'
      - 'perl'
      - '/tmp/'
      - 'base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate WordPress maintenance scripts
  - WP-CLI operations
  - Backup plugins executing system commands
level: high
---
title: Suspicious File Creation in WordPress Uploads Directory
id: 9e1d4b83-2f7c-4a58-b9e6-3c8f5a1d7e2b
status: experimental
description: Detects creation of PHP files in WordPress uploads directory, a common post-exploitation activity following successful Gravity Forms compromise.
references:
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/var/www/html/wp-content/uploads/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
  selection_action:
    - 'create'
    - 'write'
    - 'modify'
  condition: selection_path and selection_ext and selection_action
falsepositives:
  - Plugin/theme updates that write to uploads directory
  - Legitimate file uploads with PHP handler misconfiguration
level: medium

// Hunt for Gravity Forms exploitation attempts and post-exploitation activity
// Time range: Last 7 days
union isfuzzy=true
    (
    // Web server logs - exploitation attempts
    CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where DeviceVendor =~ "Apache" or DeviceProduct contains "nginx"
    | where RequestMethod == "POST"
    | where RequestURL has_any ("admin-ajax.php", "index.php", "wp-json")
    | where AdditionalExtensions has_any ("O:8:", "O:9:", "a:1:{", "serialize")
    | where AdditionalExtensions has "gform"
    | project TimeGenerated, SourceIP, RequestURL, RequestMethod, AdditionalExtensions, DeviceAction
    ),
    (
    // Process execution - PHP spawning shells
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName in~ ("php", "php-fpm", "apache2", "httpd", "nginx")
    | where FileName in~ ("sh", "bash", "curl", "wget", "nc", "python", "perl")
    | where ProcessCommandLine has_any ("/tmp/", "base64", "eval", "system", "exec")
    | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName, RemoteIP
    ),
    (
    // Syslog - suspicious file writes in uploads
    Syslog
    | where TimeGenerated > ago(7d)
    | where SyslogMessage has "wp-content/uploads"
    | where SyslogMessage has_any (".php", ".phtml")
    | where SyslogMessage has_any ("create", "write", "modify")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
    ),
    (
    // Network connections from web server processes
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName in~ ("php", "php-fpm", "apache2", "httpd")
    | where RemotePort in (80, 443, 8080)
    | where RemoteIPType == "Public"
    | where RemoteUrl !has_any ("wordpress.org", "wordpress.com", "gravityforms.com")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
    )
| order by TimeGenerated desc

-- CVE-2026-103039: Hunt for Gravity Forms exploitation artifacts
-- Identifies suspicious processes, file modifications, and network activity

LET suspicious_processes = SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    PPid
FROM pslist()
WHERE 
    (Name =~ "php|apache|httpd|nginx" AND CommandLine =~ "sh|bash|curl|wget|nc |python|perl")
    OR (CommandLine =~ "/tmp/|base64|eval|system\(|exec\(")

LET uploads_php_files = SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime
FROM glob(globs="/var/www/html/wp-content/uploads/**/*.php")
WHERE Mtime > (now() - (7 * 24 * 60 * 60))
ORDER BY Mtime DESC

LET suspicious_connections = SELECT 
    Pid,
    Name,
    LocalAddr,
    LocalPort,
    RemoteAddr,
    RemotePort,
    State
FROM netstat()
WHERE 
    Name =~ "php|apache|httpd|nginx"
    AND State =~ "ESTABLISHED"
    AND RemoteAddr !~ "^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.)"

SELECT 
    'Suspicious Process' AS IndicatorType,
    Pid AS PID,
    Name AS ProcessName,
    CommandLine AS CommandLine,
    Username AS Username,
    CreateTime AS Timestamp,
    NULL AS FilePath,
    NULL AS RemoteAddress
FROM suspicious_processes

UNION ALL

SELECT 
    'Modified PHP File' AS IndicatorType,
    NULL AS PID,
    NULL AS ProcessName,
    NULL AS CommandLine,
    NULL AS Username,
    Mtime AS Timestamp,
    FullPath AS FilePath,
    NULL AS RemoteAddress
FROM uploads_php_files

UNION ALL

SELECT 
    'Outbound Connection' AS IndicatorType,
    Pid AS PID,
    Name AS ProcessName,
    NULL AS CommandLine,
    NULL AS Username,
    NULL AS Timestamp,
    NULL AS FilePath,
    RemoteAddr + ':' + RemotePort AS RemoteAddress
FROM suspicious_connections
ORDER BY Timestamp DESC

#!/bin/bash
# CVE-2026-103039: Gravity Forms Vulnerability Scanner and Remediation Script
# Checks for vulnerable Gravity Forms installations on WordPress sites

set -e

RED='\033[0;31m'
YELLOW='\033[1;33m'
GREEN='\033[0;32m'
NC='\033[0m' # No Color

VULNERABLE_VERSION="3.1.2"
PATCHED_VERSION="3.1.3"

echo "================================================"
echo "Gravity Forms CVE-2026-103039 Detection Script"
echo "================================================"
echo ""

# Function to compare version numbers
version_compare() {
    if [[ $1 == $2 ]]; then
        return 0
    fi
    local IFS=.
    local i ver1=($1) ver2=($2)
    for ((i=${#ver1[@]}; i<${#ver2[@]}; i++)); do
        ver1[i]=0
    done
    for ((i=0; i<${#ver1[@]}; i++)); do
        if [[ -z ${ver2[i]} ]]; then
            ver2[i]=0
        fi
        if ((10#${ver1[i]} > 10#${ver2[i]})); then
            return 1
        fi
        if ((10#${ver1[i]} < 10#${ver2[i]})); then
            return 2
        fi
    done
    return 0
}

# Search common WordPress installation paths
WP_PATHS=(
    "/var/www/html"
    "/var/www/wordpress"
    "/var/www/vhosts"
    "/home/*/public_html"
    "/usr/share/nginx/html"
)

VULNERABLE_SITES=()
PATCHED_SITES=()
NO_GRAVITY_FORMS=()

echo "Scanning for WordPress installations..."
echo ""

for wp_path in "${WP_PATHS[@]}"; do
    # Expand wildcards
    for site_path in $wp_path; do
        if [ ! -d "$site_path" ]; then
            continue
        fi
        
        # Check if this is a WordPress installation
        if [ ! -f "$site_path/wp-config.php" ]; then
            continue
        fi
        
        echo "Found WordPress installation: $site_path"
        
        # Check for Gravity Forms plugin
        GF_PATH="$site_path/wp-content/plugins/gravityforms"
        if [ ! -d "$GF_PATH" ]; then
            echo -e "  ${GREEN}[OK]${NC} Gravity Forms not installed"
            NO_GRAVITY_FORMS+=("$site_path")
            continue
        fi
        
        # Get Gravity Forms version
        GF_VERSION=$(grep "Version:" "$GF_PATH/gravityforms.php" | head -1 | awk '{print $2}' | tr -d '\r\n ')
        
        if [ -z "$GF_VERSION" ]; then
            echo -e "  ${YELLOW}[WARNING]${NC} Could not determine Gravity Forms version"
            continue
        fi
        
        echo "  Gravity Forms version: $GF_VERSION"
        
        # Compare versions
        version_compare "$GF_VERSION" "$VULNERABLE_VERSION"
        result=$?
        
        if [ $result -eq 0 ] || [ $result -eq 2 ]; then
            echo -e "  ${RED}[VULNERABLE]${NC} Gravity Forms $GF_VERSION is affected by CVE-2026-103039"
            VULNERABLE_SITES+=("$site_path:$GF_VERSION")
        else
            echo -e "  ${GREEN}[PATCHED]${NC} Gravity Forms $GF_VERSION is not vulnerable"
            PATCHED_SITES+=("$site_path:$GF_VERSION")
        fi
        echo ""
    done
done

echo ""
echo "================================================"
echo "SCAN RESULTS"
echo "================================================"
echo ""

echo -e "${RED}VULNERABLE SITES (${#VULNERABLE_SITES[@]}):${NC}"
for site in "${VULNERABLE_SITES[@]}"; do
    echo "  - $site"
done
echo ""

echo -e "${GREEN}PATCHED SITES (${#PATCHED_SITES[@]}):${NC}"
for site in "${PATCHED_SITES[@]}"; do
    echo "  - $site"
done
echo ""

echo "Sites without Gravity Forms: ${#NO_GRAVITY_FORMS[@]}"
echo ""

if [ ${#VULNERABLE_SITES[@]} -gt 0 ]; then
    echo -e "${RED}CRITICAL: Immediate action required!${NC}"
    echo ""
    echo "REMEDIATION STEPS:"
    echo "1. Update Gravity Forms to version 3.1.3 or later immediately"
    echo "2. Update via WordPress admin: Plugins > Installed Plugins > Gravity Forms > Update"
    echo "3. Or download from: https://www.gravityforms.com/my-account/downloads/"
    echo "4. After updating, review site logs for signs of compromise"
    echo "5. Check wp-content/uploads for suspicious PHP files"
    echo "6. Review user accounts for unauthorized administrator accounts"
    echo ""
    echo "For WP-CLI users:"
    for site in "${VULNERABLE_SITES[@]}"; do
        site_path=$(echo $site | cut -d: -f1)
        echo "  cd $site_path && wp plugin update gravityforms"
    done
    exit 1
else
    echo -e "${GREEN}No vulnerable Gravity Forms installations detected.${NC}"
    exit 0
fi

   - Or for nginx:
     ```
location ~* /wp-content/uploads/.*\.php$ {
  deny all;
}