GF Zoho CRM CVE-2025-62981
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Network-reachable open redirect requiring victim click (UI:R); scope changes as redirect crosses origin trust boundary; C:L reflects indirect credential risk via phishing.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Phishing.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.8.
AnalysisAI
Open redirect in the WP Gravity Forms Zoho CRM and Bigin WordPress plugin (versions ≤ 1.2.8) allows unauthenticated remote attackers to redirect victims from a trusted WordPress site to an arbitrary attacker-controlled URL, enabling phishing attacks. The CVSS Scope:Changed designation reflects that the trust boundary of the originating WordPress site is crossed, lending legitimacy to malicious links. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.03% (8th percentile) confirms very low observed exploitation probability at time of analysis.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site) arises when an application accepts attacker-supplied URL parameters and issues an HTTP redirect without validating that the destination falls within an allowlisted domain or path. The affected product is the 'gf-zoho' WordPress plugin by CRM Perks, which bridges Gravity Forms (a popular WordPress form builder) with Zoho CRM and Bigin SaaS platforms. The plugin likely processes redirect or return-URL parameters as part of its OAuth or form-submission flow integrating with Zoho's API. Without server-side validation of the redirect destination, any URL can be injected, causing the victim's browser to leave the legitimate WordPress origin. No CPE string was provided in the available data; the affected software is identified by WordPress plugin slug 'gf-zoho', versions through 1.2.8.
Affected ProductsAI
The WP Gravity Forms Zoho CRM and Bigin plugin by CRM Perks, WordPress plugin slug 'gf-zoho', is affected in all versions from the initial release through and including version 1.2.8. No CPE string was supplied in the available data; the affected software is identified through the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/gf-zoho/vulnerability/wordpress-wp-gravity-forms-zoho-crm-and-bigin-plugin-1-2-8-open-redirection-vulnerability. Version 1.2.9 or later should be considered as the target remediated release, but an exact confirmed fixed version was not independently specified in the available intelligence.
RemediationAI
Update the gf-zoho plugin to the version released after 1.2.8 as directed by the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/gf-zoho/vulnerability/wordpress-wp-gravity-forms-zoho-crm-and-bigin-plugin-1-2-8-open-redirection-vulnerability - note that the exact patched version number is not confirmed in the available data and should be verified against the WordPress plugin repository or vendor changelog before updating. If an immediate update cannot be applied, a compensating control is to deactivate the gf-zoho plugin until patching is possible, which eliminates the attack surface at the cost of losing Zoho CRM/Bigin form integration. A Web Application Firewall rule blocking outbound redirect responses to external domains (i.e., enforcing same-origin redirect enforcement at the WAF layer) can reduce exploitability but carries a risk of breaking legitimate redirect flows within the plugin. No generic workaround is available within WordPress core for plugin-level open redirects.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the path
Share
External POC / Exploit Code
Leaving vuln.today