CVE-2025-60180

Critical

Published: 18/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Salesforce plugin (gf-salesforce-crmperks) up to version 1.5.1, allowing Object Injection.

Risk Assessment

Attackers may exploit the vulnerability to execute malicious code or take over the WordPress site.

Recommendation

Update the plugin to the latest version and restrict access to Gravity Forms.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Object Injection.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.5.1.