WordPress Gravity Forms Plugin Malware Found

A significant security threat has recently been detected in one of the most widely used WordPress plugins—Gravity Forms. This alarming discovery highlights a supply chain attack that allowed hackers to insert malicious code into the plugin itself, putting countless websites at risk of remote code execution and data exposure. Understanding the nature of this vulnerability, its implications, and how to respond quickly is crucial for anyone managing WordPress sites relying on Gravity Forms.

What Happened? A Supply Chain Attack on Gravity Forms

Gravity Forms, a popular WordPress plugin known for creating versatile online forms, became the target of a sophisticated supply chain attack. What makes supply chain attacks so dangerous is that they bypass traditional security measures by compromising the software’s distribution system rather than individual websites. In this case, attackers managed to upload a compromised version of the Gravity Forms plugin directly to the official plugin repository.

The malicious actors did not just alter the plugin—they embedded harmful code in a core plugin file named gravityforms/common.php. Once installed, this infected plugin initiated unauthorized HTTP POST requests to a rogue domain, gravityapi.org. This domain was a cleverly typosquatted variation designed to mimic official Gravity Forms-related sites, having been registered only days before the attack began.

By directing site communications to this attacker-controlled server, the compromised plugin opened backdoors allowing intruders to gather detailed site and server info and, more alarmingly, execute arbitrary commands remotely on the affected websites.

Why Remote Code Execution (RCE) Is a Major Threat

Remote Code Execution vulnerabilities are among the most severe security flaws a website can face. RCE gives attackers the ability to run malicious code on a target site from a remote location. This essentially means hackers can take full control over the affected website without physical access.

In the case of the Gravity Forms breach, the malware allowed many harmful activities:

• Upload arbitrary files to the server.
• Retrieve lists of all registered WordPress users including sensitive details such as user IDs, usernames, emails, and display names.
• Delete user accounts on the site.
• Access and browse any files and directories on the server, regardless of normal permissions.

Of particular concern is the ability to view the wp-config.php file, which contains sensitive database credentials and can lead to full database compromise.

How the Gravity Forms Developers Responded

Once informed of the issue by security researchers at Patchstack—a WordPress security monitoring company—RocketGenius, the creators of Gravity Forms, took swift action. On the very same day, they released an updated, clean version of the plugin to the official repository.

Additionally, the domain registrar for the malicious website, Namecheap, stepped in to suspend the fraudulent domain gravityapi.org. This move effectively cut off the attacker’s ability to continue communicating with infected sites. Site owners relying on Gravity Forms were urged to immediately update their plugins to version 2.9.13 or later, which contains the essential fix.

What Website Owners Should Do Now

If you manage a WordPress website utilizing Gravity Forms, immediate steps are necessary to secure your site:

1. Update Gravity Forms: Navigate to your WordPress dashboard and update Gravity Forms to the latest version (2.9.13 or newer). This patched version removes the malicious code and prevents further exploitation.
2. Review User Accounts: Because attackers could delete users, check your site’s user list to ensure no unauthorized deletions have occurred. Restoring backups may be necessary if accounts are missing.
3. Scan for Malware: Use reputable WordPress security plugins or external malware scan services to detect any residual infections.
4. Change Passwords: To mitigate further risk, reset all admin passwords and any other accounts with elevated permissions. Also, change your database credentials if you suspect the wp-config.php file was compromised.
5. Monitor Site Activity: Keep an eye on your website logs and error reports for any unusual behavior indicating ongoing compromises.

Understanding the Risks of Supply Chain Attacks

This incident shines a harsh spotlight on the dangers posed by supply chain attacks in the WordPress ecosystem. Unlike attacks targeting individual sites which depend on weak passwords or outdated plugins, supply chain attacks compromise software at its source, affecting a broad user base instantly.

Because WordPress users tend to trust plugins from official repositories, attackers exploit this trust by infiltrating these sources. This enables them to quietly spread malware to thousands of websites before detection.

Site owners must be vigilant:

• Always keep plugins and themes updated.
• Choose reputable plugins with a strong track record.
• Employ security monitoring services that detect unusual changes in plugins or core files.
• Regularly back up websites to recover quickly from attacks.

The Role of Security Companies Like Patchstack

Security firms like Patchstack play a critical role by actively monitoring WordPress plugin repositories and reporting dangerous code. Their work helps detect these hidden threats early to minimize damage.

In this case, Patchstack’s advisory enabled Gravity Forms’ developers to act immediately and prevent further exploitation of the vulnerability. This underscores the importance of collaboration between developers, security researchers, and hosting providers in defending the web.

Final Thoughts: Staying Safe with WordPress Plugins

The recent malware discovery in Gravity Forms serves as a powerful reminder: no software is immune to threats. Supply chain attacks can have devastating effects quickly. Website owners must remain proactive in updating software, verifying sources, and implementing robust security measures.

By updating Gravity Forms without delay and reinforcing general security practices, site managers can protect their visitors’ data, their own digital assets, and maintain trust in their online presence.

Summary

• Gravity Forms was compromised by a supply chain attack injecting malicious code.
• The infected plugin communicated with a rogue domain to allow remote code execution.
• Malicious actions included file uploading, user listing/deletion, and unrestricted file access.
• Gravity Forms developers fixed the issue promptly and released version 2.9.13.
• Website owners should update immediately, check users, scan for malware, and change passwords.
• The attack highlights the growing threat of supply chain breaches in WordPress plugins.
• Vigilance, regular updates, and security monitoring are key defenses against such threats.

Frequently Asked Questions (FAQs)

Q1: What exactly is a supply chain attack in the context of WordPress plugins?
A supply chain attack targets the software distribution process itself instead of individual websites. For WordPress plugins, this means hackers compromise plugins at their source—such as the official repository—so when site owners download or update their plugin, they inadvertently install malicious code.

Q2: How did the malware in Gravity Forms work to compromise sites?
The injected malicious code made the plugin send information about the infected site to a fake server controlled by attackers. It also enabled hackers to upload files, list and delete user accounts, and access any file on the server, including those with sensitive data.

Q3: What should I do if I have an older version of Gravity Forms installed?
You should upgrade the plugin to version 2.9.13 or later immediately. After updating, scan your site for malware and review your user accounts to detect any unauthorized changes. Also, reset your passwords and consider changing database credentials to secure your site fully.