CVE-2025-58006: WP Gravity Forms Keap Open Redirect Flaw

CVE-2025-58006 Overview

CVE-2025-58006 is an open redirect vulnerability affecting the CRM Perks WP Gravity Forms Keap/Infusionsoft plugin for WordPress. The flaw exists in the gf-infusionsoft plugin and impacts all versions up to and including 1.2.6. Attackers can craft malicious URLs that redirect victims from the trusted WordPress site to attacker-controlled destinations, enabling phishing campaigns. The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site).

Critical Impact
Attackers can leverage the trusted domain of vulnerable WordPress sites to redirect users to phishing pages, harvesting credentials or delivering malware while bypassing user suspicion.

Affected Products

CRM Perks WP Gravity Forms Keap/Infusionsoft plugin (gf-infusionsoft)
All versions from n/a through 1.2.6
WordPress installations with the affected plugin activated

Discovery Timeline

2025-09-22 - CVE-2025-58006 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58006

Vulnerability Analysis

The vulnerability stems from improper validation of user-supplied URL parameters used in redirect functionality within the gf-infusionsoft plugin. The plugin accepts redirect target URLs without validating that the destination belongs to an allow-listed domain. Attackers construct URLs that appear to originate from the legitimate WordPress site hosting the plugin but redirect the browser to an external, attacker-controlled domain.

The attack requires user interaction, as victims must click the crafted link. The scope changes because the redirection crosses trust boundaries from the WordPress site to an untrusted destination. Confidentiality impact is limited to information a user might disclose after being redirected, typically credentials entered on a spoofed page.

Root Cause

The root cause is missing or insufficient validation of redirect target parameters. The plugin trusts URL input passed through query parameters and issues an HTTP redirect without confirming the destination host matches the origin site or an approved allow-list. This maps directly to CWE-601.

Attack Vector

An attacker crafts a URL pointing to a vulnerable endpoint on a WordPress site running the plugin. The URL contains a redirect parameter set to an attacker-controlled domain. The attacker distributes this link through email, social media, or messaging platforms. Because the initial domain appears legitimate, victims are more likely to click. Upon visiting the link, the plugin issues a redirect to the phishing site, which typically mimics the original site's login page.

Refer to the PatchStack Gravity Forms Vulnerability advisory for the specific parameter and endpoint details.

Detection Methods for CVE-2025-58006

Indicators of Compromise

HTTP requests to WordPress endpoints containing external URLs in redirect-related query parameters
Web server access logs showing referrer chains from the WordPress site to unfamiliar external domains
User reports of suspicious redirects after clicking links pointing to the WordPress site
Presence of the gf-infusionsoft plugin at version 1.2.6 or earlier

Detection Strategies

Inspect web application firewall (WAF) logs for query parameters containing full URLs or protocol-relative paths (http://, https://, //)
Correlate outbound HTTP 302 responses from WordPress endpoints with destinations outside the site's domain
Scan installed WordPress plugins to identify affected gf-infusionsoft versions

Monitoring Recommendations

Alert on HTTP redirect responses where the Location header points to a domain different from the request host
Monitor DNS and proxy logs for user traffic transitioning from the WordPress site to newly registered or low-reputation domains
Track user-reported phishing incidents referencing links to the affected site

How to Mitigate CVE-2025-58006

Immediate Actions Required

Identify all WordPress installations running the gf-infusionsoft plugin and confirm the installed version
Update the plugin to a fixed version released after 1.2.6 when available from the vendor
Deploy WAF rules that block redirect parameters containing external URLs until patching is complete
Educate users about phishing risks and encourage verification of destination URLs before entering credentials

Patch Information

The vulnerability affects gf-infusionsoft versions up to and including 1.2.6. Administrators should consult the PatchStack advisory and the WordPress plugin repository for the latest fixed release from CRM Perks. Apply the update through the WordPress admin dashboard or via WP-CLI.

Workarounds

Temporarily deactivate the gf-infusionsoft plugin if a patched version is unavailable and the functionality is not business-critical
Configure the WAF or reverse proxy to strip or reject requests containing absolute URLs in redirect-related parameters
Restrict access to affected plugin endpoints using IP allow-listing where feasible

bash

# Example WAF rule (ModSecurity) blocking external redirect parameters
SecRule ARGS:redirect_to "@rx ^(https?:)?//" \
    "id:1000601,phase:2,deny,status:403,\
    msg:'Potential open redirect attempt (CVE-2025-58006)'"