CVE-2025-60090

Critical

Published: 18/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Deserialization of untrusted data vulnerability in WP Gravity Forms Insightly allows object injection. The issue affects versions up to and including 1.1.6.

Risk Assessment

An attacker could exploit this vulnerability to execute malicious code or take control of the application, potentially leading to data integrity and confidentiality breaches.

Recommendation

It is recommended to immediately update the plugin to the latest available version that includes a security fix.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Insightly gf-insightly allows Object Injection.This issue affects WP Gravity Forms Insightly: from n/a through <= 1.1.6.