CVE-2025-60174

Critical

Published: 18/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact plugin (gf-constant-contact) up to version 1.1.2, allowing Object Injection.

Risk Assessment

Attackers may exploit the vulnerability to execute malicious code or take over the WordPress site.

Recommendation

Update the plugin to the latest version and restrict access to Gravity Forms.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.2.