If you have discovered a vulnerability in one of our products we want to hear from you as soon as possible. Please gather as much information together as you can so we can work quickly to address it. Here’s a checklist of the details we’d like to see.
- Severity (high, medium, low)
- Vulnerability Type: e.g., DoS, Overflow, XSS, CSRF, etc
- Exploitation Requires Authentication?: yes/no
- Version(s) of Gravity Forms (or Add-On) affected
- A description of the vulnerability
- Do you have reason to believe the vulnerability is being exploited?
- Are details of an exploit publicly available? If so, please provide us with a URL.
- What is the potential impact? How do you envisage it being used in an attack scenario?
- DREAD score, if known.
- CVE Identifier / Reference / Advisory Number, if applicable.
- If you wish to be credited for the responsible disclosure in the release announcement and the change log, please let us know. If you plan to disclose details of the vulnerability, please do let us know so we can coordinate the timing of the disclosure together.
- Any additional comments.
If you are a customer please open a support ticket as soon as possible and make it clear in the subject that your are reporting a security vulnerability.
If you are not a customer send all the details to [email protected]. We have developers in a few time zones so don’t assume you have to leave it till the morning.
We’ll acknowledge receipt as soon as we’ve read it. If confirmed we’ll plan a patch and let you know when we plan to release it.