CVE-2025-8606: GSheetConnector For Gravity Forms <= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation
The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23. This is due to missing or incorrect nonce validation on the activateplugin and deactivateplugin functions. This makes it possible for attackers to trick authenticated administrators into activating or deactivating specified plugins via a forged request, such as clicking on a malicious link or visiting a compromised page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8606?
CVE-2025-8606 is classified as a medium severity vulnerability due to the potential for Cross-Site Request Forgery.
How do I fix CVE-2025-8606?
To fix CVE-2025-8606, update the GSheetConnector For Gravity Forms plugin to version 1.3.24 or later.
What versions are affected by CVE-2025-8606?
CVE-2025-8606 affects GSheetConnector For Gravity Forms versions 1.3.23 and below.
What causes the vulnerability in CVE-2025-8606?
CVE-2025-8606 is caused by missing or incorrect nonce validation in the plugin's activate_plugin and deactivate_plugin functions.
Can CVE-2025-8606 be exploited remotely?
Yes, CVE-2025-8606 can be exploited remotely, allowing attackers to perform unauthorized actions if they trick an authenticated user.