SECURITY INCIDENT NOTICE: Gravity Forms 2.9.11.1

Get Help
1

I had the 2.9.11.1 on one of our sites (had JUST switched to the composer setup that very day).

I just wanted to check if what I’ve done would cover our arse as this site is in development and has had a lot of work done by the clients since the 10th, and I don’t really want to roll it back on them.

The site is a bedrock installation and has plugin downloads completely disabled on the staging env. When I ran the test URL from the incident notice I got the following error (url masked):

[14-Jul-2025 03:12:08 UTC] PHP Fatal error: Uncaught Error: Class "Gravity_Forms\Gravity_Forms\Settings\Settings" not found in <<FOLDER PATH FOR SITE>>/plugins/gravityforms/notification.php:17

Stack trace:

#0 {main}

thrown in <<FOLDER PATH FOR SITE>>/app/plugins/gravityforms/notification.php on line 17

Does that align with the compromise?

Either way, I took the following steps:

  1. Disabled the gravity forms plugins
  2. Delete the gravity forms plugins via SSH
  3. Updated on local and pushed the new lock file - which in turn downloaded the latest versions
  4. Blocked the identified IP addresses for my sites through CloudFlare’s firewall
  5. Reviewed users (no alterations or new users)
  6. Reviewed logs (nothing from the sus IP addresses or anything our of the ordinary)

Would we be good here now or is there something else I should check?

2

This fatal error message when visiting the test URL would be expected if the compromised version were installed on the site, but not active at the time of testing. If that compromised version was never activated on the site, then you should be in the clear.

3

If, at any point, you had activated that version, you will want to ensure no stray files have been injected to your core WP files.