What is the CVSS score of CVE-2025-60209?

CVE-2025-60209 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

How to fix or mitigate CVE-2025-60209?

Within 24 hours, inventory every WordPress environment for the wp-gravity-forms-spreadsheets plugin and confirm whether it is installed and active at version 1.2.6 or earlier; if active, deactivate and remove the plugin or isolate the affected site behind access controls, apply WAF/virtual patching rules to block crafted serialized input to form and integration endpoints, and preserve logs for investigation. Within 7 days, if the plugin must remain for business continuity, restrict access to its forms and data-integration endpoints, enforce least-privilege file and database permissions, remove unused plugins/themes that could supply a POP gadget chain, and monitor for unserialize/object-injection or post-exploitation activity. Within 30 days, replace the plugin with a vetted alternative or upgrade to a fixed version once the vendor releases one, complete a component inventory to eliminate unnecessary gadget-chain sources, and conduct a focused compromise assessment on any site that ran the vulnerable plugin with form access.

Gravity Forms Connector CVE-2025-60209

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Google Wordpress Plugin

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but AC:H because reliable exploitation depends on a suitable POP gadget chain being present; impact kept C/I/A:H given object-injection can yield RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:28 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Object Injection.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.6.

AnalysisAI

PHP Object Injection in the CRM Perks Connector for Gravity Forms and Google Sheets WordPress plugin (wp-gravity-forms-spreadsheets) through version 1.2.6 allows unauthenticated remote attackers to pass attacker-controlled data to an unserialize() call path when the plugin is installed, active, and processing form/data integration functionality. Meaningful impact such as RCE, file manipulation, or SQL injection depends on a usable POP gadget chain being present in the plugin, WordPress core, or another installed component, which is the key real-world limiting factor despite the high CVSS score. EPSS is low at 0.58% (46th percentile), and no public exploit code or CISA KEV entry is identified at time of analysis.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) arises when the plugin passes attacker-influenced input into PHP's unserialize() without sufficient validation, enabling PHP Object Injection. The affected component is the WordPress plugin Connector for Gravity Forms and Google Sheets (slug wp-gravity-forms-spreadsheets), versions through 1.2.6; no CPE strings were provided in the input, but tags and the Patchstack reference identify it as a WordPress plugin. If a usable gadget chain exists in the plugin, WordPress core, or another installed plugin or theme, injected objects can trigger magic methods such as __wakeup or __destruct to achieve remote code execution, file deletion or manipulation, or SQL injection. The independently assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting that exploitation is network-reachable without authentication or user interaction but has high attack complexity because a reachable POP chain is required. The original CVSS 9.8 vector with AC:L does not account for that gadget-chain dependency.

Affected ProductsAI

The affected product is the WordPress plugin Connector for Gravity Forms and Google Sheets (also CRM Perks Connector for Gravity Forms and Google Sheets), plugin slug wp-gravity-forms-spreadsheets, in versions from n/a through 1.2.6; the Patchstack advisory URL specifically references plugin version 1.2.5. No CPE string was supplied in the input data. The vendor advisory is available at Patchstack: https://patchstack.com/database/Wordpress/Plugin/wp-gravity-forms-spreadsheets/vulnerability/wordpress-connector-for-gravity-forms-and-google-sheets-plugin-1-2-5-php-object-injection-vulnerability?_s_id=cve. Sites are affected only if the plugin is installed, active, and using its Gravity Forms and Google Sheets data-processing features.

RemediationAI

No vendor-released patch or exact fixed version is identified in the provided intelligence; check the Patchstack advisory for the current patched release before upgrading. Because affected versions are through 1.2.6, upgrade the plugin to the latest version once the vendor confirms a fix, and remove or deactivate the plugin if it is not essential. If no fixed version is available, deactivate or remove the plugin - the main trade-off is loss of Gravity Forms-to-Google Sheets synchronization. Additional compensating controls include restricting or monitoring access to form submission and plugin integration endpoints and deploying a WAF rule that blocks serialized PHP object payloads in requests reaching the plugin, though false positives and incomplete coverage are possible. Reduce available gadget chains by keeping WordPress core, themes, and all other plugins updated, but note this does not eliminate risk if a chain exists in an unpatched component. Advisory: https://patchstack.com/database/Wordpress/Plugin/wp-gravity-forms-spreadsheets/vulnerability/wordpress-connector-for-gravity-forms-and-google-sheets-plugin-1-2-5-php-object-injection-vulnerability?_s_id=cve.