GravityForms 2.9.11.1 / 2.9.12 - Malware Compromise

Description

For a limited time and only via specific methods, two Gravity Forms core plugin packages offered for manual download were compromised by an external agent who made unauthorized code modifications.

Modified versions of Gravity Forms 2.9.11.1 and 2.9.12 were infected, but only a limited number of those packages were affected, and they were only available for a limited compromise window.

You may have a compromised version if you installed a Gravity Forms core package under the following conditions:

- You manually downloaded 2.9.11.1 on July 9 or 10 via your Gravity Forms account downloads page.
- You manually downloaded 2.9.12 on July 10.
- You ran a composer install and installed 2.9.11.1 on the dates above.