CVE-2025-30953: WP Gravity Forms Salesforce Open Redirect

CVE-2025-30953 Overview

CVE-2025-30953 is an open redirect vulnerability in the CRM Perks WP Gravity Forms Salesforce plugin (gf-salesforce-crmperks) for WordPress. The flaw affects all versions up to and including 1.4.7. The plugin fails to validate user-supplied redirect targets, allowing attackers to craft URLs on trusted WordPress sites that redirect victims to attacker-controlled domains. The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site) and is primarily useful for phishing campaigns that abuse the legitimate domain's reputation.

Critical Impact
Attackers can craft URLs originating from trusted WordPress domains that silently redirect victims to phishing pages or malware download sites.

Affected Products

WP Gravity Forms Salesforce plugin (gf-salesforce-crmperks) versions up to and including 1.4.7
WordPress installations running the vulnerable plugin
Sites using Gravity Forms integrated with Salesforce via CRM Perks

Discovery Timeline

2025-06-06 - CVE-2025-30953 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30953

Vulnerability Analysis

The vulnerability is an open redirect in the WP Gravity Forms Salesforce plugin. The plugin accepts a redirect destination parameter without validating that the target belongs to an allowed list or matches the site's own domain. An attacker constructs a URL pointing to the vulnerable WordPress endpoint with a manipulated redirect parameter. When a victim clicks the link, the WordPress site issues an HTTP redirect to the attacker-controlled destination.

Exploitation requires user interaction, and the attack originates over the network without authentication. The impact is limited to confidentiality through phishing, credential theft, or malware delivery — the vulnerability does not directly compromise the WordPress host.

Root Cause

The plugin passes an externally supplied URL parameter into a redirect function without verifying the scheme, host, or domain against an allowlist. Because the redirect is performed server-side by the trusted WordPress domain, browsers and email gateways treat the initial link as legitimate. The scope change reflects that the vulnerable component redirects users to a resource outside its security boundary.

Attack Vector

An attacker crafts a URL such as https://victim-site.example/?redirect=https://attacker.example/login and distributes it through email, chat, or malicious ads. The victim sees the trusted domain in the initial link and clicks. The WordPress site processes the request and redirects the browser to the attacker's phishing page, which typically mimics a legitimate login form to harvest credentials or deliver malware.

See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-30953

Indicators of Compromise

Web server access logs showing requests to plugin endpoints with URL parameters containing external domains in redirect values
HTTP 301 or 302 responses from the WordPress site with Location headers pointing to unrelated third-party domains
Referrer logs on downstream infrastructure showing traffic arriving from the WordPress site immediately before credential submissions to unrelated hosts

Detection Strategies

Inspect query strings on requests to gf-salesforce-crmperks plugin routes for parameters containing full URLs or protocol-relative paths
Alert on outbound redirects from the WordPress site where the Location header hostname does not match the site's own domain or an approved allowlist
Correlate user reports of unexpected redirects with web server logs to identify weaponized links in circulation

Monitoring Recommendations

Enable verbose access logging on the WordPress reverse proxy or web server and retain logs for at least 90 days
Deploy a web application firewall rule that flags requests containing http:// or https:// substrings inside query parameters targeting the plugin
Monitor threat intelligence feeds and brand-abuse services for weaponized URLs referencing your domain

How to Mitigate CVE-2025-30953

Immediate Actions Required

Identify all WordPress instances running the WP Gravity Forms Salesforce plugin and inventory installed versions
Update the plugin to a fixed release published after version 1.4.7 as soon as one is available from CRM Perks
Review recent web server logs for suspicious redirect parameter usage and notify users if weaponized links are found in circulation

Patch Information

The vulnerability affects WP Gravity Forms Salesforce versions through 1.4.7. Administrators should consult the Patchstack Vulnerability Report and the CRM Perks plugin page for the latest fixed release and upgrade instructions.

Workarounds

Deactivate the WP Gravity Forms Salesforce plugin until a patched version is installed if the Salesforce integration is not business-critical
Add a web application firewall rule that blocks or sanitizes requests to plugin endpoints where redirect parameters contain external hostnames
Configure the WordPress site or upstream proxy to strip or validate untrusted redirect parameters before they reach the plugin

bash

# Example WAF rule (ModSecurity) blocking external redirect targets on plugin routes
SecRule REQUEST_URI "@contains gf-salesforce-crmperks" \
  "chain,phase:2,deny,status:403,id:1009530,msg:'CVE-2025-30953 open redirect attempt'"
  SecRule ARGS "@rx ^https?://(?!victim-site\.example)" "t:none,t:lowercase"