CVE-2025-60091

Critical

Published: 18/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Deserialization of untrusted data vulnerability in WP Gravity Forms Zoho CRM and Bigin allows object injection. The issue affects versions up to and including 1.2.9.

Risk Assessment

An attacker could exploit this vulnerability to execute malicious code or take control of the application, potentially leading to data integrity and confidentiality breaches.

Recommendation

It is recommended to immediately update the plugin to the latest available version that includes a security fix.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.9.