GSheetConnector Gravity Forms CVE-2025-8593

Requires an authenticated WordPress account with subscriber-level access or above (PR:L) on a site running GSheetConnector For Gravity Forms version ≤1.3.27 - practically low-barrier on any site permitting open user registration. The specific weakness is a missing capability check on the plugin's 'install_plugin' function, allowing it to be invoked without administrative privileges. Full arbitrary code execution is not guaranteed: the description limits it to 'certain conditions,' meaning the attacker must be able to install a plugin payload that leads to execution (e.g., a malicious or exploitable plugin package and a writable environment). Limiting factors: authentication is required (no anonymous exploitation), and the RCE outcome is conditional rather than automatic; sites that disable public registration materially reduce exposure.

This is a genuine, actionable vulnerability rather than a high-CVSS-but-low-real-risk issue, though not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) indicates network-exploitable, low-complexity attack requiring only subscriber-level authentication (PR:L) and no user interaction, with full CIA impact stemming from the plausible escalation path to arbitrary code execution. Subscriber accounts are trivially obtained on any WordPress site with open registration, which sharply lowers the practical barrier. However, EPSS is only 0.43% (35th percentile), the vulnerability is NOT in CISA KEV, and no public proof-of-concept was provided in the input - so there is no evidence of active exploitation and exploitation is currently theoretical. The C:H/I:H/A:H rating assumes the plugin-install primitive is successfully chained to code execution, which the description itself hedges as achievable only 'under certain conditions'; if those conditions (e.g., a writable plugin directory / ability to install a malicious plugin package) are not met, real-world impact may be lower than the vector implies. Net: patch promptly, especially on sites allowing open subscriber registration, but this is not yet a confirmed exploited threat.

An attacker registers a low-privilege subscriber account (or uses an existing one) on a WordPress site running GSheetConnector For Gravity Forms ≤1.3.27, then sends an authenticated request invoking the unprotected 'install_plugin' function, which lacks a capability check. By installing an attacker-controlled or known-vulnerable plugin, the attacker can potentially reach arbitrary code execution on the server. No public exploit code was identified at time of analysis.