CVE-2025-60209
Published: 22 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-60209 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the CRM Perks Connector for Gravity Forms and Google Sheets WordPress plugin (wp-gravity-forms-spreadsheets). This flaw enables Object Injection and affects all versions from n/a through 1.2.6.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low attack complexity and no user interaction required. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution or system compromise through malicious object deserialization.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/wp-gravity-forms-spreadsheets/vulnerability/wordpress-connector-for-gravity-forms-and-google-sheets-plugin-1-2-5-php-object-injection-vulnerability?_s_id=cve documents the issue in the context of versions up to 1.2.6, highlighting the need for mitigation via plugin updates to patched releases.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a remotely exploitable deserialization flaw in a public-facing WordPress plugin, enabling unauthenticated attackers to achieve RCE, directly mapping to exploitation of public-facing applications.