CVE-2025-60174: WP Gravity Forms Constant Contact Plugin

CVE-2025-60174 Overview

CVE-2025-60174 is a critical deserialization of untrusted data vulnerability in the CRM Perks WP Gravity Forms Constant Contact Plugin (gf-constant-contact) for WordPress. The flaw allows PHP Object Injection and affects all plugin versions up to and including 1.1.2. An unauthenticated remote attacker can submit crafted serialized data that the plugin processes through an unsafe deserialization routine. Successful exploitation can trigger PHP object instantiation, leading to arbitrary code execution, data tampering, or full site compromise when suitable gadget chains exist in the WordPress environment. The vulnerability is tracked under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Unauthenticated attackers can achieve remote code execution and full WordPress site takeover through PHP Object Injection on any site running gf-constant-contact version 1.1.2 or earlier.

Affected Products

CRM Perks WP Gravity Forms Constant Contact Plugin (gf-constant-contact) versions through 1.1.2
WordPress installations using the affected plugin with Gravity Forms integration
All sites where the plugin processes user-supplied input via serialized data

Discovery Timeline

2025-12-18 - CVE-2025-60174 published to NVD
2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-60174

Vulnerability Analysis

The vulnerability stems from the plugin passing attacker-controllable input to PHP's unserialize() function without validation. When PHP deserializes a crafted object, it invokes magic methods such as __wakeup(), __destruct(), or __toString() on the resulting object. Attackers chain existing classes loaded in the WordPress runtime — known as POP (Property-Oriented Programming) gadgets — to execute arbitrary operations. These chains commonly leverage classes from WordPress core, Gravity Forms, or other active plugins to reach sinks such as file writes, SQL queries, or eval() equivalents.

Because the plugin integrates with Gravity Forms submission handling, the unsafe deserialization path is reachable through normal form-processing endpoints. No authentication is required to deliver the payload.

Root Cause

The root cause is the use of unserialize() on untrusted input within the plugin's request handling logic. The code path does not enforce type checking, allowed-class filtering via allowed_classes, or signature-based integrity validation before deserializing data. This violates secure deserialization guidance defined in [CWE-502].

Attack Vector

The attack is delivered over the network through HTTP requests targeting the plugin's form submission or AJAX endpoints. An attacker submits a serialized PHP object payload in a parameter that the plugin deserializes. The crafted payload references gadget classes already loaded in the WordPress process, allowing the attacker to pivot deserialization into arbitrary code execution. No user interaction or prior privileges are required.

No public proof-of-concept exploit is currently listed in Exploit-DB, and the vulnerability is not on the CISA Known Exploited Vulnerabilities catalog. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-60174

Indicators of Compromise

POST requests to Gravity Forms or gf-constant-contact endpoints containing serialized PHP markers such as O:, a:, or s: followed by class names and field counts
Unexpected outbound connections from the web server process to attacker infrastructure shortly after form submissions
New or modified PHP files in wp-content/uploads/, wp-content/plugins/, or theme directories created by the web server user
New administrative WordPress users or unexpected modifications to wp_options and wp_users tables

Detection Strategies

Inspect HTTP request bodies and query strings for serialized object signatures targeting the plugin's endpoints and quarantine matches at the WAF layer
Monitor PHP error logs for __wakeup, __destruct, or class-not-found warnings originating from the plugin's request handlers
Correlate form submission events with subsequent file system writes or process executions spawned by php-fpm or the web server user

Monitoring Recommendations

Enable verbose access logging on /wp-admin/admin-ajax.php and any Gravity Forms submission endpoints used by the plugin
Track integrity of WordPress core, plugin, and theme files using checksums and alert on unauthorized changes
Forward web server, PHP, and WordPress audit logs to a centralized SIEM and apply rules for PHP Object Injection patterns

How to Mitigate CVE-2025-60174

Immediate Actions Required

Identify all WordPress sites running the gf-constant-contact plugin and confirm the installed version against 1.1.2
Deactivate and remove the plugin if no patched version is available in your environment until a fix is verified
Deploy WAF rules that block requests containing serialized PHP object payloads targeting the plugin's endpoints
Review WordPress administrator accounts, scheduled tasks (wp_cron), and recently modified files for signs of compromise

Patch Information

At the time of NVD publication, the vendor advisory information available is the Patchstack Vulnerability Report. Administrators should monitor the WordPress plugin repository for an update beyond version 1.1.2 and apply it immediately when available. Replace any direct calls to unserialize() with safer alternatives such as json_decode() or, where serialized data is required, pass ['allowed_classes' => false] to constrain deserialization.

Workarounds

Disable the gf-constant-contact plugin until a patched release is installed
Restrict access to Gravity Forms submission and AJAX endpoints using IP allow-listing or authentication where business workflows permit
Configure the web server or WAF to drop requests whose bodies match serialized PHP object patterns such as O:\d+:" and a:\d+:{

bash

# Example ModSecurity rule to block serialized PHP object payloads
SecRule ARGS|REQUEST_BODY "@rx (?:^|[=&])(O|a|s):\d+:\"" \
  "id:1060174,phase:2,deny,status:403,log,\
   msg:'CVE-2025-60174: PHP serialized object detected in request'"