The Gravity Forms WordPress Plugin Supply Chain Attack

What happened

Attackers added malicious code to the plugin package that the official site served. Patchstack reports that the attacker registered the domain gravityapi.org on 8 July 2025. People downloaded the bad plugin on 9 and 10 July. Patchstack received reports on 11 July, and RocketGenius released 2.9.13 the same day.

Patchstack found the code in gravityforms/common.php and includes/settings/class-settings.php. It ran whenever the plugin was active, and it did two things:

• It sent site data to the attacker. This included the site URL, WordPress and PHP versions, active plugins and user count.
• It downloaded a Base64-encoded PHP file and wrote it to disk. BleepingComputer names wp-includes/bookmark-canonical.php. Patchstack also lists wp-includes/block-caching.php.

A second backdoor accepted requests with a secret token. With it, an attacker can create administrator accounts, run PHP code, upload files and list or delete users. BleepingComputer adds that the code blocked update attempts.

Patchstack states that the infection did not seem widespread. BleepingComputer and SecurityWeek put the plugin at about one million sites in total. Only sites that took the bad packages in the window were exposed.

Vigilance compares the version you trust with the new one. It reports the file that gained a new capability. A plugin that starts calling an outside domain is the kind of change it shows. See the scan block below.

Affected versions

• Gravity Forms 2.9.11.1 and 2.9.12, downloaded manually from gravityforms.com on 9 and 10 July 2025.
• Composer installs made from the official site during the same window. BleepingComputer states that a Composer install of 2.9.11 on 10 to 11 July was affected. SecurityWeek says 2.9.11.1.
• Fixed in 2.9.13.

Installs from the WordPress.org repository were not affected, according to Patchstack.

Indicators of compromise

• Domains: gravityapi.org and gravityapi.io.
• IP addresses: 185.193.89.19 and 193.160.101.6.
• Files: wp-includes/bookmark-canonical.php and wp-includes/block-caching.php.
• A reference to gravityapi.org in gravityforms/common.php.
• A list_sections function in includes/settings/class-settings.php.
• Administrator accounts that nobody on your team created.

How to check

Search the plugin folder and wp-includes for the domain and the dropped files. Run this in the WordPress root.

grep -rIl "gravityapi" wp-content/plugins/gravityforms; ls -l wp-includes/bookmark-canonical.php wp-includes/block-caching.php

Then check the version with WP-CLI.

wp plugin get gravityforms --field=version

A version of 2.9.13 or later does not prove a clean site. A site that ran a bad version can still hold the dropped file. Also list administrator accounts with wp user list --role=administrator.

What to do now

1. Update Gravity Forms to 2.9.13 or later from a trusted source.
2. Delete the dropped files in wp-includes if they exist.
3. Remove administrator accounts that you do not recognize.
4. Change all administrator, database and hosting passwords. Rotate the WordPress salts.
5. Block the domains and IP addresses above.
6. If you find the backdoor, restore the site from a backup made before 9 July 2025 or rebuild it.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 64

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    common.php
           It now downloads from the internet, runs other programs and runs a hidden, encoded command. It did not before.

Sources

1. patchstack.com/articles/critical-malware-found-in-gravityforms-official-plugin-site/
2. bleepingcomputer.com/news/security/wordpress-gravity-forms-developer-hacked-to-push-backdoored-plugins/
3. securityweek.com/hackers-inject-malware-into-gravity-forms-wordpress-plugin/