GSheetConnector Gravity Forms CVE-2025-8606

Exploitation requires that a WordPress administrator with a valid authenticated session actively visits an attacker-controlled page or clicks a malicious link while logged in (UI:R) - the flaw cannot be triggered against an idle or logged-out target. The specific precondition is that the GSheetConnector For Gravity Forms plugin (version ≤1.3.23) is installed and active, and that its activate_plugin and deactivate_plugin handlers lack valid nonce verification. Limiting factors: the attacker gains no code execution or data access, only the ability to toggle plugin activation state; success is gated entirely on social-engineering a privileged admin, and any administrator awareness or request-origin checks (e.g., referer validation, security plugins) would further reduce realistic exploitability.

This is a low-priority issue despite the network attack vector. The CVSS 3.1 base score is 2.4 (Low) with vector AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N, and the only impact is a limited integrity change (I:L) - toggling plugin activation state - with no confidentiality or availability loss as scored. EPSS reinforces this with a 0.15% exploitation probability (4th percentile), among the lowest tiers. There is no CISA KEV listing and no public exploit identified, so no signals contradict the low-risk picture; all available indicators are consistent. The one nuance worth flagging: this is a CSRF (CWE-352) flaw, where the attacker holds no privileges but must trick a logged-in administrator (reflected in UI:R and the description's reference to 'authenticated administrators'). The input's PR:H is an unusual choice for CSRF - conventionally the attacker is unauthenticated and PR:N is used - so the 'privileges required' metric reflects the victim's session, not the attacker's; this does not change the overall Low verdict but is worth noting when comparing to standard CSRF scoring.

An attacker crafts a web page or email link containing a forged request targeting the plugin's activate_plugin/deactivate_plugin functionality. When a currently authenticated WordPress administrator visits the malicious page or clicks the link, their browser silently submits the request, causing arbitrary plugins to be activated or deactivated without the admin's knowledge. No public exploit code has been identified, and success depends entirely on social-engineering a logged-in admin.