PT-2025-52150 · WordPress · Crm Perks Wp Gravity Forms Salesforce

Phat Rio · Published 2025-12-18 · Updated 2025-12-18 · CVE-2025-60180

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CRM Perks WP Gravity Forms Salesforce versions through 1.5.1

Description A flaw exists in CRM Perks WP Gravity Forms Salesforce that allows for object injection due to deserialization of untrusted data. This issue could potentially allow for malicious code execution.

Recommendations Update CRM Perks WP Gravity Forms Salesforce to a version later than 1.5.1.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-60180

Affected Products

Crm Perks Wp Gravity Forms Salesforce

References · 5

• https://osv.dev/vulnerability/CVE-2025-60180 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60180 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/gf-salesforce-crmperks/vulnerability/wordpress-wp-gravity-forms-salesforce-plugin-1-5-1-php-object-injection-vulnerability?_s_id=cve · Note
• https://vdp.patchstack.com/database/Wordpress/Plugin/gf-salesforce-crmperks/vulnerability/wordpress-wp-gravity-forms-salesforce-plugin-1-5-1-php-object-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2001736607976583524 · Twitter Post