CVE-2025-60178

Critical

Published: 18/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot plugin (gf-hubspot) up to version 1.2.6, allowing Object Injection.

Risk Assessment

Attackers may exploit the vulnerability to execute malicious code or take over the WordPress site.

Recommendation

Update the plugin to the latest version and restrict access to Gravity Forms.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Object Injection.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.6.