CVE-2025-54681: Gravity Forms Google Sheets Open Redirect

CVE-2025-54681 Overview

CVE-2025-54681 is an open redirect vulnerability [CWE-601] affecting the CRM Perks Connector for Gravity Forms and Google Sheets WordPress plugin (wp-gravity-forms-spreadsheets). The flaw impacts all plugin versions up to and including 1.2.4. Attackers can craft URLs that appear to originate from a trusted WordPress site but redirect visitors to attacker-controlled domains. This enables phishing campaigns that abuse the trust associated with the host site. The vulnerability requires user interaction to trigger the redirect and does not require authentication.

Critical Impact
Attackers can leverage a trusted WordPress host to redirect victims to malicious phishing infrastructure, bypassing visual URL inspection by users and email filters.

Affected Products

CRM Perks Connector for Gravity Forms and Google Sheets plugin (wp-gravity-forms-spreadsheets)
All versions from initial release through 1.2.4
WordPress installations using the affected plugin alongside Gravity Forms

Discovery Timeline

2025-08-14 - CVE-2025-54681 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54681

Vulnerability Analysis

The plugin accepts a user-controlled URL parameter and uses it as a redirect target without validating that the destination points to an allowlisted domain. When a victim clicks a crafted link pointing to the vulnerable WordPress site, the plugin performs an HTTP redirect to the attacker-supplied location. Because the initial hostname belongs to the legitimate site, users and security tooling that rely on domain reputation may treat the link as safe. The Exploit Prediction Scoring System (EPSS) currently places the probability of exploitation activity at a low tier, but open redirects are commonly weaponized in phishing kits.

Root Cause

The root cause is missing or insufficient validation of a redirect target parameter, classified under [CWE-601] URL Redirection to Untrusted Site. The plugin does not verify that the target URL resolves to the same origin or an approved allowlist before issuing the redirect. Any absolute URL supplied to the vulnerable endpoint is honored.

Attack Vector

An attacker crafts a link to the vulnerable WordPress site with a manipulated redirect parameter pointing to a phishing page. The attacker distributes the link through email, social media, or search-engine poisoning. When the victim clicks the link, the vulnerable plugin redirects the browser to the attacker-controlled destination. The victim sees a familiar domain in the original URL and is more likely to enter credentials on the follow-on phishing site. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-54681

Indicators of Compromise

Web server access logs showing requests to plugin endpoints with external URLs in query parameters such as redirect, url, return, or next.
HTTP 302 or 301 responses from the WordPress host redirecting to unfamiliar external domains.
Referrer logs on downstream infrastructure showing traffic originating from the vulnerable WordPress site to unrelated third-party domains.

Detection Strategies

Inspect web server and WAF logs for query parameters containing absolute URLs pointing to domains outside the site's own hostname.
Alert on anomalous redirect patterns where a single WordPress endpoint sends users to many distinct external destinations over short intervals.
Correlate email gateway telemetry with outbound clicks that transit the vulnerable WordPress host before reaching credential-harvesting pages.

Monitoring Recommendations

Track the installed version of wp-gravity-forms-spreadsheets across WordPress inventories and flag any instance at or below 1.2.4.
Monitor DNS and proxy logs for user traffic that begins on the trusted WordPress domain and terminates on newly registered or low-reputation domains.
Enable phishing-focused URL reputation checks on outbound web traffic to identify chained redirects that begin with a trusted host.

How to Mitigate CVE-2025-54681

Immediate Actions Required

Update the CRM Perks Connector for Gravity Forms and Google Sheets plugin to a version later than 1.2.4 as soon as a fixed release is available from the vendor.
Audit all WordPress deployments for the presence of wp-gravity-forms-spreadsheets and prioritize patching internet-facing sites.
Notify user awareness teams so phishing simulations and training reflect the risk of trusted-domain redirects.

Patch Information

Refer to the Patchstack Vulnerability Report for vendor patch status and remediation guidance. Sites should upgrade to any release beyond 1.2.4 that addresses the open redirect. If no fixed version exists, deactivate the plugin until the vendor issues a fix.

Workarounds

Deactivate and remove the plugin from affected WordPress sites until a patched release is applied.
Configure a web application firewall rule that blocks requests to plugin endpoints when redirect parameters contain absolute URLs referencing external hostnames.
Restrict redirect targets at the reverse proxy layer by rewriting or dropping responses whose Location header points outside the site's own domain.

bash

# Example ModSecurity rule to block external redirect parameters
SecRule ARGS_NAMES "@rx (redirect|url|return|next|goto)" \
  "chain,id:1005481,phase:2,deny,status:403,log,msg:'CVE-2025-54681 open redirect attempt'"
  SecRule ARGS "@rx ^https?://(?!example\.com)" "t:lowercase"