PT-2025-41678 · WordPress · Gsheetconnector For Gravity Forms

Wesley · Published 2025-10-11 · Updated 2025-10-11 · CVE-2025-8606

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GSheetConnector For Gravity Forms plugin for WordPress versions prior to 1.3.24

Description The software is susceptible to Cross-Site Request Forgery due to inadequate nonce validation in the activate plugin and deactivate plugin functions. This allows attackers to potentially trick authenticated administrators into activating or deactivating plugins through a forged request, such as a malicious link or compromised webpage.

Recommendations Update to version 1.3.24 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-8606

Affected Products

Gsheetconnector For Gravity Forms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-8606 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d5c48de7-20f6-408e-b4fb-f3d5d7ab272f?source=cve · Note
• https://plugins.trac.wordpress.org/browser/gsheetconnector-gravity-forms/tags/1.3.23/includes/class-gravityform-gs-service.php#L154 · Note
• https://t.me/CVEtracker/34671 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3339653 · Note
• https://twitter.com/VulmonFeeds/status/1977021928922640818 · Twitter Post
• https://twitter.com/CVEnew/status/1976948517433491614 · Twitter Post
• https://plugins.trac.wordpress.org/browser/gsheetconnector-gravity-forms/tags/1.3.23/includes/class-gravityform-gs-service.php#L39 · Note