CVE-2025-47456: WP Gravity Forms Zendesk Open Redirect

CVE-2025-47456 Overview

CVE-2025-47456 is an open redirect vulnerability affecting the CRM Perks WP Gravity Forms Zendesk WordPress plugin (gf-zendesk). The flaw exists in all versions up to and including 1.1.2. Attackers can craft malicious URLs that appear to originate from a trusted WordPress site but redirect victims to attacker-controlled destinations. This vulnerability is classified under [CWE-601] URL Redirection to Untrusted Site and enables phishing campaigns that abuse the trust relationship between users and the legitimate WordPress domain.

Critical Impact
Attackers can leverage the trusted WordPress domain to redirect users to phishing pages, credential harvesters, or malware distribution sites while bypassing URL reputation checks.

Affected Products

CRM Perks WP Gravity Forms Zendesk plugin (gf-zendesk)
All versions from initial release through 1.1.2
WordPress installations using the affected plugin

Discovery Timeline

2025-05-07 - CVE-2025-47456 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47456

Vulnerability Analysis

The gf-zendesk plugin integrates Gravity Forms with Zendesk and processes redirect parameters as part of its OAuth or callback flow. The plugin fails to validate destination URLs against an allowlist of trusted hosts before issuing an HTTP redirect. An attacker can supply an arbitrary external URL as a parameter value, and the plugin returns a redirect response pointing to that URL.

The vulnerability requires user interaction. A victim must click a crafted link that appears to point to the legitimate WordPress site hosting the plugin. Because the initial hostname is trusted, security controls that rely on URL reputation or domain filtering may permit the request. The scope is changed because the redirect crosses a security boundary from the vulnerable WordPress site to an attacker-controlled origin.

Root Cause

The root cause is missing or insufficient validation of a URL parameter used in a redirect response. The plugin trusts input controlled by the request and passes it directly to a redirect function without confirming the target host matches an approved domain. See the Patchstack WordPress Vulnerability Advisory for advisory details.

Attack Vector

The attack proceeds over the network with low complexity and no authentication. An attacker distributes a phishing link containing the vulnerable endpoint and a redirect_to style parameter pointing to a malicious domain. The victim clicks the link, the WordPress site returns a redirect, and the browser lands on the attacker's page. The impact is confidentiality loss through credential theft or session token capture on the destination page.

No verified proof-of-concept code has been published. The EPSS score is 0.263% at the 17.9 percentile, indicating low observed exploitation activity to date.

Detection Methods for CVE-2025-47456

Indicators of Compromise

HTTP 302 or 301 responses from gf-zendesk plugin endpoints containing external Location headers pointing to unfamiliar domains.
Web server access logs showing requests to plugin endpoints with URL parameters containing full external URLs, especially URL-encoded values or double-encoded payloads.
Referrer logs on downstream systems showing traffic originating from the affected WordPress site but landing on unrelated destinations.

Detection Strategies

Inspect WordPress access logs for requests to gf-zendesk plugin paths containing parameters with http:// or https:// values in query strings.
Deploy web application firewall rules that flag redirect parameters whose destination hostname does not match the site's own domain.
Correlate outbound user clickstream data with inbound phishing email indicators to identify campaigns abusing the redirect.

Monitoring Recommendations

Monitor plugin directory contents and version metadata to confirm all sites run a patched release.
Alert on anomalous spikes in traffic to plugin endpoints, which may indicate active phishing campaigns weaponizing the redirect.
Track domain reputation of external hosts appearing in redirect responses from your WordPress infrastructure.

How to Mitigate CVE-2025-47456

Immediate Actions Required

Update the gf-zendesk plugin to a version later than 1.1.2 as soon as the vendor publishes a fix.
Audit WordPress sites in your inventory for the presence of gf-zendesk and record current installed versions.
Review recent access logs for evidence of exploitation attempts targeting plugin redirect parameters.

Patch Information

Refer to the Patchstack advisory for the current patch status. Versions through 1.1.2 are affected. Apply the vendor patch once released through the WordPress plugin repository.

Workarounds

Deactivate the gf-zendesk plugin until a patched version is installed if the integration is not business-critical.
Configure a web application firewall rule that rejects requests to plugin endpoints when redirect parameters contain external hostnames.
Restrict access to Gravity Forms Zendesk integration endpoints by IP allowlist where operationally feasible.

bash

# Example WAF rule concept (ModSecurity syntax) blocking external redirect targets
SecRule ARGS_NAMES "@rx (redirect|return|url|next|target)" \
    "chain,deny,status:403,id:1047456,msg:'Blocked external redirect on gf-zendesk endpoint'"
    SecRule ARGS "@rx ^https?://(?!yourdomain\.com)" "t:none,t:urlDecodeUni"