CVE-2023-28782

CVE-2023-28782 is a critical Deserialization of Untrusted Data vulnerability affecting Rocketgenius Inc. Gravity Forms versions up to 2.7.3. With a CVSS score of 9.8, it allows unauthenticated attackers to execute arbitrary code remotely with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered community discussion and media coverage, indicating awareness and potential for future exploitation. Organizations using affected Gravity Forms versions should prioritize patching to mitigate this severe risk.