External risk intelligence

WordPress Connector for Gravity Forms and Google Sheets Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-60209

The vulnerability affects a WordPress plugin designed to integrate Gravity Forms with Google Sheets. As this is a web-based plugin component that processes form submissions and external data integrations, it is commonly deployed on public-facing websites and is reachable via the web server's network path.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Connector for Gravity Forms and Google Sheets plugin, allowing untrusted data to be deserialized. This could potentially lead to the injection of malicious objects, impacting the integrity and availability of systems that utilize this integration. The primary concern is confirming the relevance and exposure of this plugin within our environment.

Plugin allows external data to be run.
It could impact web applications and data.
Confirm if this plugin is used internally.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted data to the Connector for Gravity Forms and Google Sheets plugin. This data, when processed, triggers a deserialization flaw, allowing the attacker to inject malicious objects into the system. Successful exploitation could lead to a complete compromise of the application.

No authentication or user interaction needed.
Unsanitized data triggers object injection.
Full system compromise is possible.

Live Threat

Current exploitation, exposure, and threat context

A deserialization of untrusted data vulnerability in the Connector for Gravity Forms and Google Sheets plugin could allow an unauthenticated attacker to inject malicious objects into a vulnerable system. This could occur when the plugin processes untrusted input, potentially leading to unauthorized actions or data manipulation.

Plugin data and system integrity may be at risk.
Untrusted input processing could lead to exposure.
Unrestricted code execution or data corruption is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The CRM Perks Connector for Gravity Forms and Google Sheets is likely managed by the application owner or platform team responsible for the WordPress environment. The immediate next step is to identify all instances of this plugin, confirm their exposure and business criticality, and then coordinate remediation with the accountable owner.

Application owner must prioritize this.
Verify plugin reachability and criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Connector for Gravity Forms and Google Sheets plugin?

This is a WordPress plugin used to bridge form data from Gravity Forms into Google Sheets for automated tracking. It functions as a connector component within a CMS environment, specifically designed to handle the movement and integration of data between web forms and spreadsheet platforms.

What does deserialization of untrusted data mean for CVE-2025-60209?

The vulnerability is categorized as CWE-502, or Deserialization of Untrusted Data. In plain terms, the plugin fails to safely check data it receives from external sources before turning that data into objects for the program to use. An attacker can craft malicious inputs that the plugin misinterprets as legitimate instructions, potentially allowing them to compromise the application.

How is this deserialization flaw triggered in the plugin?

The vulnerability is triggered when the plugin processes specially crafted input data that it does not adequately sanitize. It does not require a user to log in or interact with the site to succeed. Simply navigating to or interacting with the endpoint that processes this data is sufficient; standard legitimate usage of the plugin without malicious payloads will not trigger the vulnerability.

Is my website at risk from this WordPress plugin vulnerability?

According to Halo Surface Signal, this plugin is frequently used on public-facing websites to process form submissions and external data. Because the plugin is reachable via the web server's network path, sites using the affected version (1.2.6 or earlier) are exposed to attackers on the internet who can reach the site directly.

What should I do if I have this plugin installed?

Your first step is to perform an inventory of your WordPress environments to identify where this plugin is active. Once identified, evaluate the criticality of the plugin to your operations. Coordinate with your application owners or platform administrators to prepare for remediation and minimize the potential for unauthorized data manipulation or system compromise.

References

patchstack.com/database/Wordpress/Plugin/wp-gravity-forms-spreadshee…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.