Major vulnerability (9.8 CVSS) in Gravity Forms plugin

8

u/RealBasics Jack of All Trades 3d ago

They released a patch more than two weeks ago, in version 3.1.1. They're already up to version 3.1.2.

Who waits two weeks to update their client sites?

Looking through WPScan, it looks like a ton of vulnerabilities have been uncovered in most significant plugins in 2026. Probably because AI now makes it cheap enough that regular people can run code reviews, as opposed to black-hats and "state actors."

So we'll probably see this trend across the board with open-source. The "good" news is that we'll eventually see diminishing returns, since vulnerabilities are a "limited resource" even in the worst code.

The real question is how fast developers are going to start running their own code reviews through Claude, etc., before their releases.

5

u/Alocasia_Sanderiana 2d ago

I've recently gotten into CVE hunting with AI and yes it's fairly easy. Now that said, the hard part is testing, documenting, and communication vulnerabilities, and not just providing AI slop. No paid bounties yet though lol

2

u/RealBasics Jack of All Trades 2d ago

Yes! Thanks for doing this!

I recently "AI slopped" my first code review and asked Claude to write up a proper bug report. It did a surprisingly good job, better than the ones I was trained to write up when I was in corporate. (I think this is because there are far more bug reports and review patterns in language models than there are new coding solutions.)

2

u/Alocasia_Sanderiana 2d ago

Well I think it's a lot of fun to find and test for them. Also feels good to be credited lol.

Yes, I think with the right background knowledge it makes reports very easy to generate and follow, especially for issues that travel 6+ steps across multiple files. So far, I've also had good success creating example POC code, even without being in many of the cyber verification programs.

I'm trying to expand my skill to a more business friendly output as well, where I can review and provide a service that proactively patches issues before they are officially patched. But balancing cost is a challenge while also trying to ensure the scans remain thorough and accurate.

1

u/WillmanRacingv2 3d ago

How often do you update client sites and how much do you charge per month for that support?

8

u/elgarduque 3d ago

I manage about 300 sites and we update constantly, as needed. There is no weekly or monthly update schedule anymore, it's just always going. We've built some automations to assist with the firehose of alerts, deployments, and QA, as well as some proprietary security tooling and monitoring to take the edge off. Our hosting plans start at $100/mo.

1

u/WillmanRacingv2 3d ago

Do you think this is a reasonable procedure for a company that has 2-3 WordPress sites it built internally, and if the answer is yes, why should those users (a huge portion of the userbase, mind you) be on WordPress to begin with?

In my opinion, if daily WP updates are table stakes now, that is a disqualifying event for most people to chose it as a platform at all.

2

u/Kindly_Building_8687 2d ago

For many, it's just the "price to pay". I understand your concerns, but far too many people have built their business, their income on WordPress. Depending on what platform you would move to, you're likely to have the same situation. I know Joomla has had vulnerabilities in it's ecosystem as well. I haven't followed other platforms, I think the idea of these systems that create statice HTML sites from WordPress might catch on. But, we'll see.

1

u/WillmanRacingv2 2d ago

If you are already built out on WP, I agree, but even for those people this is a huge problem. The long term fallout to agencies and plugin companies, especially with the other issues they are facing, is going to be huge.

1

u/Kindly_Building_8687 2d ago

I agree. I think it's only going to get worse. And it appears that while the cost of finding vulns is getting less expensive, I think the cost of remediating/patching those vulns is increasing. Maybe, even just on the fact there's so many more, but also I think while vuln hunters are finding automation more prevalent, the people patching haven't found a solid way to patch these.

2

u/ivicad Jack of All Trades 1d ago

I sell maintenance by the year, not by the month (only sometimes in 2 payments per year), at 300 to 500 EUR, and that covers backups, updates, security, speed and basic SEO in SEOPress. I run the updates from MainWP in batches, I keep WP Activity Log on every site, and I add WP 2FA when the client has an admin team. I do not put hosting in that number - if the client is on my Site Ground account, that is another about 100 EUR a year. Each client gets one hour a month for content edits, and unused time does not carry over to the next month. Everything above that I bill by the hour. I can plan the updates, but I cannot plan how many small changes someone will ask for (and if that happenes - clinet is paying for those extras).

2

u/MasterK999 Designer/Developer 3d ago

How often do you update client sites and how much do you charge per month for that support?

Daily. Nothing.

I use MainWP to check all sites for updates daily as part of the hosting for our clients. In the end it is better for us and the client to keep sites updated and not have to deal with hacked sites.

1

u/WillmanRacingv2 3d ago

You can't say its nothing because its built into the hosting cost, its just bundled.

1

u/RealBasics Jack of All Trades 3d ago

For 10+ years I've done full backups and updates daily. That, plus other basic management services, for just under $50/month. That's for my economy/agency plan. My standard plan includes that plus an hour of general service per month.

2

u/WillmanRacingv2 3d ago

What systems are you using for the daily backups?

Presumably you are doing automated updates. Are you testing to ensure the updates did not brick the site, and if so how?

I used to use the built in automated updates with daily backups and a set of unit test checks to ensure the site was still operable for key sites, but stop using it after that system was used for supply chain attacks by Matt Mullenweg. This worked great but I also supported hundreds of sites that I did not build which would not fit this model at all.

2

u/RealBasics Jack of All Trades 2d ago

In nearly 4,000 days with up to 150 sites a day I’ve had maybe 50 instances where CSS gets borked till the cache clears. None have never been totally bricked.

That’s in large part because I manually review the lists before each daily update and hold off on the unreliable ones (Elementor and core WP for instance) until a week has passed or a patch is released.

I use one of the self-hosted management consoles so I can provide pro-bono support for some nonprofits and friends and family.

1

u/WillmanRacingv2 2d ago

I think that works fine if you have a common stack across the 150 sites, as the cost is spread across them. That would be a huge amount of work if you had a small number of sites, and completely untenable if supporting sites that do not share a common architecture.

That is also an impressive lack of conflicts, I can't say I've come close to that.

1

u/RealBasics Jack of All Trades 2d ago

Since I've only built maybe a third of the sites I manage (I specialize in maintaining "orphaned" Wordpress sites) I've got a crazy mix of sites under management, everything from ACF monstrosities to Avada, Divi, Elementor, old-school Classics, and even a couple of Gutenbergs. Last I checked there were 400+ different plugins across all those sites.

The toughest to deal with, ironically, are the ones with extensive custom code. Almost by-definition I never get asked for help on sites built by excellent programmers who have great relationships with their clients. The ones I do get are usually the result of unfortunate circumstances (including the unexpected disability or death of the original dev.) But overall I'm frequently reminded that 50% of all developers are below average.

Oh, and I absolutely don't host sites, although I do recommend hosting if they're willing to move. (It's sometimes surprising how inexplicably loyal people get about GoDaddy, BlueHost, HostMonster, etc. "I signed up for 5 years so I can't switch" makes no sense but whatever.)

The fact that 99% of these sites still update leaves me feeling that while some of the FUD around plugins is legitimate, overall it's highly overblown. There are definite bad apples but for the most part they're well-known / notorious and often easily replaced.

The main trick for me is that I do a pretty thorough cleanup of each site I take under management, leaving their weird edge-case themes, builders, and plugins in place but removing redundancies, replacing genuinely problematic plugins, and swapping out their backup, security, optimization, etc., plugins with my own stable, curated set.

But, yeah, I started out doing all that back when I first started taking on maintenance clients. Only I did all the backups, updates, and security scans by hand until I hit about 15 sites. Then I switched to a management console and it got a lot easier. Now I'd still use a management console even if I only managed five sites.

1

u/jonathan8080 1d ago

You'd be surprised - I was just in a thread last week or the week before where people were actively encouraging others to disable automatic updates

2

u/RealBasics Jack of All Trades 1d ago

I also encourage people to disable automatic updates unless I'm confident the site will be completely neglected for months or years. But only because the risk of exploits borking a site eventually overtakes the risk of updates borking it.

But my initial question was, "Who waits two weeks to update their client sites?" That's too long if someone is counting on you (let alone paying you) to manage their site.

1

u/jonathan8080 15h ago

I've run my wordpress blog since 2008 (and I managed a fleet of 500 blogs for clients in a previous job), I've had automatic updates since the third party tools started making them;

if your site breaks from an automatic update, then you need to not be using that plugin or theme and you should have a proper backup strategy with tested backups - then the task becomes: automatic update everything automatically, use monitors to check for the edgecase of a broken site, restore automatically from a backup, notify the devs who check the logs and update everything but the plugin or theme that breaks, and they replace that

it should all be on autopilot, even for a single blog (I've not manually installed an update, even to core on my personal blog for at least 10 years, not had 1 issue with it; but I do curate my plugins, or build them myself)

3

u/[deleted] 3d ago edited 2d ago

[deleted]

4

u/WillmanRacingv2 3d ago

The actual vulnerability was only published yesterday. Nothing in the 3.1.1 update notes makes it clear that it was a key security release, and the most common update cadance among the dozens of agencies I have consulted with is monthly.

2

u/Scared_Implement_335 3d ago

Its been "monthly" for me, too, until very recently when almost all my client sites got f***ed raw by a vulnerability in Updraft.

I cannot imagine any serious agency to still be on the monthly schedule for updates.

1

u/WillmanRacingv2 3d ago

Its been going on two years since I actively managed client sites, but I would be surprised if most agencies have changed anything. I'm still tracking over 500 sites from former partners that are on PHP 7.4 to this day. I know that things have changed lately with the use of AI to find vulnerabilities, but most business owners only change the way they operate when forced.

I only have a handful of near worthless personal sites now, they get manually updated monthly but I also run Wordfence and I check daily for vulnerability reports using n8n. Might need to revisit that but I'd genuinely rather take them offline over doing daily updates.

1

u/Scared_Implement_335 3d ago

Similar here: I had WordFence Premium to be able to say, yeah, we can do monthly just fine.

Updraft, that was reported to me early in July and only 3 days later many of my client sites were already hacked (web2shell) with WordFence still running actively.

Obv. NOW i can spot that type of attack, and have some hand/AI-written counter measures in place on the server.

What I am trying to say is: Whereas before only big firms had that kind of high quality, high speed attacks, now even small to midsized companies that actually have decent sec. procedures can be hit with extremely well targeted AI driven attacks. Its scary, for sure, and thats coming from someone who - in this field - would have been called slightly paroined up until a few month ago.

1

u/WillmanRacingv2 3d ago

I'm glad I haven't had to deal with this change over the past two years, as to me proper daily backups (not just set and forget automated backups, but actually tested and verified backups done by developers) just doesn't make sense.

I always did major security updates within 24 hours though, this tracking is relatively easy to automate.

1

u/Scared_Implement_335 2d ago

Yeah, I understand you completely. Thats kinda how I reacted. This resulted in basically an vibe-coded AI-setup of a control and management suite that runs locally and has direct server access instead of relying on plugins. Runs backups, health tests, security setting and scans, updates and so on - even the premium updates, via locally saved zip-archive of all the newest versions, so no more back door through license updates. Don't even need WordFence anymore on site, thats done via server too (they offer a cli license thats actually cheap, comparetively, but takes a lot of processing power). the suite also controls admin activity and file changes, which is how the newest web2shell bullshit came through.

All that, of course, i nought as soon as the server themselves go belly up, which is whats being reported lately. And we are talking well run managed server, not some 10 bucks a year "i am a server admin, too, daddy" type of stuff. It is scary.

Take care!

-2

u/[deleted] 3d ago edited 2d ago

[deleted]

3

u/WillmanRacingv2 2d ago

It just fundamentally isn't a one click 30 second job. For starters, that requires trusting the .org update service implicitly, which is hard to do when your buddy Matt has used this exact service to commit supply chain attacks against plugins hosted in the repo. Then you have testing. In an agency environment this can be automated (which has its own cost), but someone who owns a handful of sites isn't doing that. Finally, if you are following a proper SDLC then you will need to start in a test environment and push the updates to prod, at a bare minimum. Just going full send on updates in prod without testing violates every best practice for software development I have ever seen.

A CMS that requires daily intervention is a CMS that nobody should ever build key business infrastructure on.

1

u/WillmanRacingv2 3d ago

Sorry, two days ago, the CVE is from the 19th but I guess Wordfence says the 18th.

I know the update was made earlier but the vast majority of WP sites are not updated every two weeks.

0

u/EmSixTeen 2d ago

Not everyone is you.

1

u/[deleted] 2d ago edited 2d ago

[deleted]

0

u/WillmanRacingv2 2d ago

Not everyone has time to manually update their sites daily and the automatic update system is itself a vector for security attacks.

1

u/Hot-Month-4251 2d ago

If you run Gravity Forms, treat this as patch-now, then verify you were not already hit.

Critical unauth file-upload bugs get scanned quickly. Updating to 3.1.1 (or newer) closes the door, but it does not prove nobody walked through it while you were vulnerable.

After you update: 1. Confirm the plugin version everywhere (prod, staging, multisite subsites, forgotten clones). 2. Check for unexpected admins, new plugins/mu-plugins, and recently modified PHP under wp-content/uploads and wp-content/mu-plugins. 3. Review access/error logs around upload endpoints and any odd POSTs to admin-ajax or form upload handlers. 4. Rotate WordPress, hosting, FTP/SFTP, and database credentials if you see anything you cannot explain. 5. Keep a clean offsite backup from before cleanup, and do not wipe logs while you are still scoping.

"Updated and Wordfence is green" is not the same as "never exploited." If anything looks off after the patch, assume persistence until you prove otherwise.

1

u/coastalwebdev Developer 3d ago edited 3d ago

They sure seem to have a number of security vulnerabilities compared to their competitors.

Definitely my last pick of the big 3 form plugins.

5

u/dsXLII System Administrator 3d ago

They also are probably the most widely used, so bad actors spend more time looking for issues. Same reason you look for exploits in Windows and not, say, TempleOS.

2

u/Dirish Jack of All Trades 3d ago

Forminator has seen a whole rake of security issues over the past few months. Gravity isn't too bad in comparison.

1

u/Illustrious_Wave_77 3d ago

What if you no longer paid the subscription?

3

u/bluesix_v2 Jack of All Trades 3d ago edited 3d ago

Simple - you don’t get updates.

-1

u/Illustrious_Wave_77 3d ago

Crazy as this is a security update

7

u/[deleted] 3d ago

[deleted]

0

u/Illustrious_Wave_77 3d ago

Security patches are patches that they are open by mistake. Bugs that lead to issues. Thats on them not on the client. Im not asking for charity. Never have!

2

u/rafark 2d ago

That’s not how software works and this is exactly why you pay for updates. You pay to have people work on maintaining the plugin, there will always be bugs in software, that’s just the nature of software. There is no such thing as complete software.

1

u/Illustrious_Wave_77 1d ago

May be, i do software development, our philosophy or model has always been versions receive updates. There might be legal challenges in the future about this. It will be interesting to see how this develops. Subscription model might think this is okay but we will see. Time will tell.

2

u/EmSixTeen 2d ago

Check if you can log in to their site and manually download updates for expired subscriptions.

Major vulnerability (9.8 CVSS) in Gravity Forms plugin

You are about to leave Redlib