CVE-2025-8606
BaseFortify
Publication date: 2025-10-11
Last updated on: 2025-10-14
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gravity_forms | gsheetconnector_gravity_forms | 1.3.23 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the GSheetConnector For Gravity Forms WordPress plugin versions up to 1.3.23. It occurs because the plugin lacks proper nonce validation on its activate_plugin and deactivate_plugin functions. This allows attackers to trick authenticated administrators into unknowingly activating or deactivating plugins by making them click a malicious link or visit a compromised webpage.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to cause an authenticated administrator to activate or deactivate plugins without their consent. This could disrupt website functionality, potentially enabling further attacks or causing service interruptions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the version of the GSheetConnector For Gravity Forms plugin installed on your WordPress site. If the version is less than or equal to 1.3.23, it is vulnerable. There are no specific network detection commands provided. To check the plugin version, you can use WordPress CLI commands such as `wp plugin list` to see installed plugin versions.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the GSheetConnector For Gravity Forms plugin to a version higher than 1.3.23 where the nonce validation issue is fixed. Additionally, ensure that only trusted administrators have access to activate or deactivate plugins to reduce risk.