CVE-2025-60091: WP Gravity Forms Zoho Object Injection

CVE-2025-60091 Overview

A critical Deserialization of Untrusted Data vulnerability has been identified in the CRM Perks WP Gravity Forms Zoho CRM and Bigin plugin (gf-zoho) for WordPress. This vulnerability allows Object Injection attacks, enabling remote attackers to potentially execute arbitrary code or manipulate application behavior by injecting malicious serialized objects. The vulnerability affects all versions of the plugin through version 1.2.9.

Critical Impact

This Object Injection vulnerability can be exploited remotely without authentication, potentially leading to complete site compromise, data theft, and persistent backdoor installation.

Affected Products

• CRM Perks WP Gravity Forms Zoho CRM and Bigin plugin versions through 1.2.9
• WordPress installations using the gf-zoho plugin
• Sites integrating Gravity Forms with Zoho CRM or Bigin services

Discovery Timeline

• 2025-12-18 - CVE-2025-60091 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-60091

Vulnerability Analysis

This vulnerability falls under CWE-502 (Deserialization of Untrusted Data), a dangerous flaw that occurs when an application deserializes data from untrusted sources without proper validation. In the context of the WP Gravity Forms Zoho CRM and Bigin plugin, the application processes serialized PHP objects without adequately verifying their integrity or origin.

When PHP's unserialize() function processes attacker-controlled data, it can instantiate arbitrary classes and trigger their magic methods (such as __wakeup(), __destruct(), or __toString()). If exploitable "gadget chains" exist within the WordPress environment or installed plugins, attackers can leverage these chains to achieve arbitrary code execution, file manipulation, or database access.

Root Cause

The root cause of this vulnerability stems from the plugin's handling of serialized data without implementing proper input validation or sanitization. The affected code path accepts user-controllable input and passes it directly to PHP's deserialization functions. This design flaw allows attackers to craft malicious serialized payloads that, when processed, instantiate arbitrary objects with attacker-controlled properties.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can craft a malicious HTTP request containing a specially crafted serialized PHP object. When the vulnerable plugin processes this request, the malicious payload is deserialized, potentially triggering a chain of method calls that leads to code execution.

The attack typically involves:

1. Identifying available PHP classes in the WordPress installation that contain exploitable magic methods
2. Constructing a serialized object payload that chains these methods together
3. Sending the payload to the vulnerable endpoint
4. Exploiting the resulting code execution to establish persistence or exfiltrate data

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-60091

Indicators of Compromise

• Unusual PHP serialized strings in HTTP request parameters or POST data containing O: (object) markers
• Unexpected file creation or modification in WordPress directories, particularly in wp-content/uploads/ or plugin directories
• Suspicious outbound network connections from the web server
• New administrator accounts or modified user privileges without authorization
• Web shell files or backdoors appearing in plugin or theme directories

Detection Strategies

• Monitor web application logs for requests containing serialized PHP object patterns (e.g., O:[0-9]+:"[a-zA-Z_]+")
• Implement Web Application Firewall (WAF) rules to detect and block serialized object injection attempts
• Deploy file integrity monitoring to detect unauthorized changes to WordPress core files and plugins
• Review PHP error logs for deserialization-related errors or unexpected class instantiation warnings
• Use endpoint detection solutions to identify post-exploitation behaviors such as reverse shell connections

Monitoring Recommendations

• Enable detailed logging for HTTP requests to the WordPress installation, particularly focusing on the gf-zoho plugin endpoints
• Configure alerting for any attempts to access common web shell paths or unusual script executions
• Monitor for unexpected process spawning from web server processes (e.g., www-data or apache users)
• Implement egress filtering and monitor for unusual outbound connections from the WordPress server

How to Mitigate CVE-2025-60091

Immediate Actions Required

• Immediately update the WP Gravity Forms Zoho CRM and Bigin plugin to a patched version if available from the vendor
• If no patch is available, consider temporarily disabling the plugin until a fix is released
• Review WordPress access logs for any indicators of exploitation attempts
• Conduct a thorough security audit of the WordPress installation to identify any signs of compromise
• Implement additional WAF rules to block serialized object injection attempts

Patch Information

Site administrators should check the official WordPress plugin repository or the CRM Perks vendor website for an updated version that addresses this vulnerability. The vulnerability affects versions through 1.2.9, so any version newer than this should contain the fix. Review the Patchstack advisory for the latest patch status.

Workarounds

• Disable the gf-zoho plugin temporarily until a patched version is available
• Implement strict input validation at the web server or WAF level to block serialized PHP objects
• Restrict access to WordPress admin and plugin endpoints using IP-based access controls
• Consider using a WordPress security plugin that includes object injection detection capabilities
• Remove unnecessary PHP classes and plugins that could serve as gadget chains for exploitation

# Configuration example - Disable the vulnerable plugin via WP-CLI
wp plugin deactivate gf-zoho --path=/var/www/html/wordpress

# Verify the plugin is disabled
wp plugin list --path=/var/www/html/wordpress | grep gf-zoho