CVE-2025-60180: WP Gravity Forms Salesforce Vulnerability

CVE-2025-60180 Overview

A critical deserialization of untrusted data vulnerability has been identified in the CRM Perks WP Gravity Forms Salesforce plugin (gf-salesforce-crmperks) for WordPress. This vulnerability allows attackers to perform PHP Object Injection attacks, potentially leading to remote code execution, data manipulation, or complete site compromise. The flaw exists in versions up to and including 1.5.1 and can be exploited remotely without authentication.

Critical Impact

Unauthenticated attackers can inject malicious serialized objects into the WordPress application, potentially achieving remote code execution, sensitive data exfiltration, or full administrative access to affected WordPress sites.

Affected Products

• CRM Perks WP Gravity Forms Salesforce plugin versions through 1.5.1
• WordPress installations using the gf-salesforce-crmperks plugin
• Sites integrating Gravity Forms with Salesforce via this plugin

Discovery Timeline

• 2025-12-18 - CVE CVE-2025-60180 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-60180

Vulnerability Analysis

This vulnerability stems from the insecure handling of serialized PHP data within the WP Gravity Forms Salesforce plugin. PHP Object Injection (CWE-502) occurs when an application deserializes user-controllable data without proper validation, allowing attackers to inject arbitrary objects into the application's execution context.

When exploited, an attacker can craft a malicious serialized payload that, upon deserialization, instantiates objects with attacker-controlled properties. If the application contains classes with magic methods such as __wakeup(), __destruct(), or __toString() that perform sensitive operations, the attacker can chain these methods (known as a "POP chain" or Property-Oriented Programming chain) to achieve code execution or other malicious outcomes.

The network-accessible nature of this vulnerability, combined with no authentication requirements, makes this particularly dangerous for WordPress sites using this integration plugin.

Root Cause

The root cause is the use of PHP's unserialize() function on user-supplied input without adequate sanitization or validation. The plugin fails to implement proper security controls such as:

• Allowlist validation of expected object types
• Input sanitization before deserialization
• Use of safer serialization formats like JSON

This allows attackers to inject crafted serialized data that the application blindly trusts and deserializes, instantiating objects that can trigger dangerous code paths within WordPress or other installed plugins.

Attack Vector

The attack is conducted remotely over the network without requiring any authentication or user interaction. An attacker can submit a specially crafted HTTP request containing a malicious serialized PHP payload to a vulnerable endpoint. When the plugin processes this request and deserializes the payload, the injected objects are instantiated in memory.

The exploitation requires the presence of suitable "gadget" classes in the WordPress installation that have exploitable magic methods. Common WordPress installations and popular plugins often contain such classes, making this a highly exploitable vulnerability in real-world scenarios.

The vulnerability mechanism involves the plugin accepting serialized PHP data through web requests and passing it to the unserialize() function. Attackers construct payloads that leverage existing class definitions in the WordPress ecosystem to perform malicious actions during the deserialization process. For detailed technical information, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-60180

Indicators of Compromise

• Unusual or malformed HTTP POST requests containing serialized PHP object strings (e.g., O: or a: patterns) targeting plugin endpoints
• Unexpected file creation or modification in WordPress directories, particularly in wp-content/plugins/ or upload directories
• Anomalous database modifications or new administrator accounts appearing without authorized creation
• Error logs containing PHP object instantiation errors or unexpected class loading
• Outbound network connections from the web server to unknown external hosts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing serialized PHP objects in parameters
• Monitor web server access logs for requests to the gf-salesforce-crmperks plugin endpoints with suspicious payloads
• Deploy file integrity monitoring on WordPress core files and plugin directories
• Use SentinelOne Singularity to detect post-exploitation behavior such as web shell deployment or lateral movement attempts
• Enable PHP error logging and monitor for deserialization-related warnings or errors

Monitoring Recommendations

• Configure real-time alerting for new user account creation, especially administrator accounts
• Monitor for changes to wp-config.php and other critical WordPress configuration files
• Track process execution chains originating from the web server process (Apache/Nginx)
• Implement egress filtering and monitor for anomalous outbound connections from WordPress servers
• Review plugin activity logs for unusual Salesforce integration operations

How to Mitigate CVE-2025-60180

Immediate Actions Required

• Update the WP Gravity Forms Salesforce plugin to the latest patched version immediately if available
• If no patch is available, deactivate and remove the gf-salesforce-crmperks plugin until a fix is released
• Review WordPress user accounts and remove any unauthorized administrator accounts
• Check file system integrity for any unauthorized file modifications
• Implement WAF rules to block serialized PHP object payloads

Patch Information

Currently, this vulnerability affects versions through 1.5.1 of the WP Gravity Forms Salesforce plugin. Site administrators should check the Patchstack vulnerability database for the latest patch status and update information from CRM Perks. Enable automatic plugin updates or regularly check for security patches.

Workarounds

• Deactivate the WP Gravity Forms Salesforce plugin until a patched version is available
• Implement a Web Application Firewall with rules to detect and block PHP serialized object injection attempts
• Restrict network access to WordPress admin areas using IP allowlisting
• Consider using alternative Salesforce integration solutions that have been recently security audited
• Deploy SentinelOne Singularity for WordPress to provide runtime protection against exploitation attempts

# Deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate gf-salesforce-crmperks

# Verify the plugin is deactivated
wp plugin list --status=inactive | grep gf-salesforce-crmperks

# Check for any unauthorized admin users
wp user list --role=administrator --format=table