CVE-2025-8606 GSheetConnector For Gravity Forms <= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation
Attackers can trick admins into activating or deactivating plugins via CSRF, potentially disrupting site functionality or enabling further attacks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-8606?
CVE-2025-8606 is a low-severity vulnerability in westerndeal GSheetConnector for Gravity Forms – Send Gravity Forms Entries to Google Sheets in Real-Time, published on 11 Oct 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23. This is due to missing or incorrect nonce validation on the activate_plugin and deactivate_plugin functions. This makes it possible for attackers to trick authenticated administrators into activating or deactivating specified plugins via a forged request, such as clicking on a malicious link or visiting a compromised page.
Weakness: CWE-352
Which versions are affected by CVE-2025-8606?
How do I fix CVE-2025-8606?
No fix has been published for CVE-2025-8606 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-8606 being exploited?
There is no known exploitation of CVE-2025-8606 in the wild and no public exploit code.
Sources
Also known as GHSA-7h92-gq8q-gpxg.