Gravity Forms Google Sheet Connector, CVE-2025-8606

CVE, Research URL: CVE-2025-8606
Home page URL: Security reports for Gravity Forms Google Sheet Connector
Application: Gravity Forms Google Sheet Connector
Published on: Oct 11, 2025
Research Description: The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23. This is due to missing or incorrect nonce validation on the activate_plugin and deactivate_plugin functions. This makes it possible for attackers to trick authenticated administrators into activating or deactivating specified plugins via a forged request, such as clicking on a malicious link or visiting a compromised page.
Affected versions: max 1.3.24.
Status: vulnerable