CVE-2025-30954: Gravity Forms Constant Contact Plugin Vuln

CVE-2025-30954 Overview

CVE-2025-30954 is an open redirect vulnerability in the CRM Perks WP Gravity Forms Constant Contact Plugin (gf-constant-contact) for WordPress. The flaw affects all plugin versions up to and including 1.1.0. Attackers can craft URLs that appear to originate from a trusted WordPress site but redirect victims to attacker-controlled destinations. This behavior enables phishing campaigns and credential theft by abusing the site's trusted domain reputation. The issue is classified under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Attackers can leverage the trusted domain of a vulnerable WordPress site to redirect users to malicious phishing pages, bypassing user suspicion and URL-based security filters.

Affected Products

CRM Perks WP Gravity Forms Constant Contact Plugin (gf-constant-contact)
All versions from n/a through 1.1.0
WordPress installations using the affected plugin

Discovery Timeline

2025-06-06 - CVE-2025-30954 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30954

Vulnerability Analysis

The vulnerability is an open redirect flaw in the gf-constant-contact WordPress plugin. The plugin accepts a user-controlled URL parameter and passes it to a redirect function without validating that the destination belongs to an allowlist of trusted hosts. Attackers construct links that begin with the legitimate WordPress site's domain but forward the browser to a phishing site under attacker control.

Exploitation requires user interaction. A victim must click the crafted link, which typically arrives through email, chat, or social media. Because the initial URL displays the trusted site's hostname, users and email security gateways are less likely to flag it as malicious.

The impact is limited to confidentiality at low scope, with no direct effect on integrity or availability of the WordPress site itself. However, the scope is marked as changed because the impact extends beyond the vulnerable component to the user's browser session and any downstream credentials disclosed on the phishing destination.

Root Cause

The root cause is missing or insufficient validation of a redirect target parameter within the plugin. The code path passes attacker-supplied input directly into a redirect response header without confirming the destination host matches the expected site domain. This is a classic CWE-601 pattern.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker crafts a URL pointing to the vulnerable plugin endpoint on a target WordPress site, appending a redirect parameter that references an attacker-controlled domain. The attacker then distributes this URL through phishing channels. When a victim clicks the link, the WordPress site issues an HTTP redirect to the malicious destination, which typically hosts a credential harvesting page mimicking a trusted service such as Constant Contact, Microsoft 365, or the WordPress admin login.

The vulnerability mechanism is described in the Patchstack advisory. No verified public exploit code is available.

Detection Methods for CVE-2025-30954

Indicators of Compromise

HTTP 301 or 302 responses from WordPress sites with Location headers pointing to external, non-allowlisted domains
Access log entries containing gf-constant-contact plugin endpoints with suspicious redirect query parameters
User reports of unexpected redirects from the organization's WordPress site to unfamiliar login pages
Outbound referrer traffic from the WordPress domain to newly registered or low-reputation domains

Detection Strategies

Inspect web server access logs for requests to gf-constant-contact plugin URLs containing external URL values in query parameters
Deploy web application firewall (WAF) rules that flag redirect parameters referencing off-domain hosts
Correlate email security telemetry with URL clicks that traverse the vulnerable WordPress domain before landing on external hosts

Monitoring Recommendations

Enable HTTP response logging on the WordPress reverse proxy to capture all 3xx redirects and their Location targets
Monitor plugin version inventory for WordPress installations running gf-constant-contact at or below version 1.1.0
Alert on outbound redirects from public-facing WordPress sites to domains not present in an internal allowlist

How to Mitigate CVE-2025-30954

Immediate Actions Required

Identify all WordPress instances running the gf-constant-contact plugin and confirm the installed version
Update the plugin to a patched release above 1.1.0 as soon as one is published by CRM Perks
If no patched version is available, deactivate and remove the plugin until a fix is released
Notify users and customers to be alert for phishing emails referencing the organization's WordPress domain

Patch Information

At the time of publication, review the Patchstack advisory for the latest patched version information. Administrators should apply the plugin update through the WordPress admin dashboard or via WP-CLI once available.

Workarounds

Deactivate the gf-constant-contact plugin until a patched release is installed
Deploy a WAF rule that blocks requests to plugin endpoints containing external URLs in redirect parameters
Configure the web server or reverse proxy to strip or validate redirect_to, url, and similar parameters against an allowlist of trusted hosts
Educate users to verify the final destination in the browser address bar after clicking links, especially those requesting credentials

bash

# Example WAF rule (ModSecurity) blocking off-domain redirect parameters
SecRule REQUEST_URI "@contains gf-constant-contact" \
  "chain,phase:2,deny,status:403,id:1009540,\
  msg:'CVE-2025-30954 Open Redirect Attempt'"
  SecRule ARGS "@rx ^https?://(?!example\.com)" \
    "t:none,t:urlDecodeUni"