Cross-Site Request Forgery in GSheetConnector for Gravity Forms Plugin by WordPress
CVE-2025-8606
2.4LOW
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 October 2025
What is CVE-2025-8606?
The GSheetConnector for Gravity Forms plugin is susceptible to Cross-Site Request Forgery due to inadequate nonce validation in its activation and deactivation processes. This vulnerability enables attackers to exploit authenticated administrator sessions, potentially leading to unauthorized activation or deactivation of plugins through malicious links or compromised web pages.
Affected Version(s)
GSheetConnector For Gravity Forms * <= 1.3.23