Gravity Forms FreshDesk CVE-2025-67587
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Requires user interaction to follow redirect; no direct system impact; only facilitates phishing.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Phishing.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.
AnalysisAI
Open redirect in CRM Perks WP Gravity Forms FreshDesk Plugin up to 1.3.5 allows unauthenticated attackers to craft URLs that redirect users to arbitrary untrusted sites, facilitating phishing attacks. The vulnerability has no known active exploitation or public exploit, and EPSS indicates a very low exploitation probability.
Technical ContextAI
The vulnerability is an Open Redirect (CWE-601) in the WordPress plugin 'gf-freshdesk', which integrates Gravity Forms with Freshdesk. It likely arises from insufficient validation of a redirect URL parameter after a form submission, allowing an attacker to specify an external domain. The plugin processes web requests in a typical PHP environment without correctly restricting the target, enabling redirection to malicious sites. The affected CPE is cpe:2.3:a:crmperks:wp_gravity_forms_freshdesk_plugin:*:*:*:*:*:wordpress:*:* up to version 1.3.5 inclusive.
Affected ProductsAI
CRM Perks WP Gravity Forms FreshDesk Plugin (gf-freshdesk) versions from n/a through 1.3.5 are vulnerable. The Plugin is hosted on the WordPress.org repository, and the advisory is available at https://patchstack.com/database/Wordpress/Plugin/gf-freshdesk/vulnerability/wordpress-wp-gravity-forms-freshdesk-plugin-plugin-1-3-5-open-redirection-vulnerability?_s_id=cve.
RemediationAI
Update the WP Gravity Forms FreshDesk Plugin to a version later than 1.3.5; the exact patched version is not confirmed in available data, but the next release after 1.3.5 should contain the fix. If an update is not immediately available, disable the plugin or restrict its redirect functionality by implementing web application firewall rules that verify the redirect target is a trusted domain, or by manually editing the plugin code to whitelist allowed redirect URLs. Note that disabling the plugin will interrupt the Freshdesk integration. Monitor the vendor's page or the WordPress plugin repository for a new release.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today