CVE-2025-60180: WP Gravity Forms Salesforce Vulnerability

CVE-2025-60180 Overview

CVE-2025-60180 is a PHP Object Injection vulnerability in the CRM Perks WP Gravity Forms Salesforce plugin for WordPress. The flaw stems from deserialization of untrusted data [CWE-502] in the gf-salesforce-crmperks plugin. All versions through 1.5.1 are affected.

Attackers can exploit this issue remotely over the network without authentication or user interaction. Successful exploitation enables object injection, which can lead to arbitrary code execution, data tampering, or denial of service depending on the PHP magic methods available in the application context.

Critical Impact
Unauthenticated remote attackers can inject malicious PHP objects into the Gravity Forms Salesforce integration, potentially compromising the full WordPress site and connected Salesforce data flows.

Affected Products

CRM Perks WP Gravity Forms Salesforce plugin (gf-salesforce-crmperks)
All versions from n/a through 1.5.1
WordPress installations using the plugin for Salesforce CRM integration

Discovery Timeline

2025-12-18 - CVE-2025-60180 published to the National Vulnerability Database (NVD)
2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-60180

Vulnerability Analysis

The vulnerability is classified as Deserialization of Untrusted Data [CWE-502], commonly referred to as PHP Object Injection. The plugin passes attacker-controlled input to PHP's unserialize() function without adequate validation. When PHP deserializes a crafted payload, it instantiates arbitrary class objects available in the WordPress runtime.

If any loaded class defines magic methods such as __wakeup, __destruct, or __toString, these methods execute during or after deserialization. Attackers chain such methods into POP (Property-Oriented Programming) gadgets to achieve file writes, SQL queries, or code execution.

The attack vector is network-based with low complexity and requires no privileges or user interaction. The plugin handles form submissions destined for Salesforce, which gives unauthenticated remote attackers a reachable entry point.

Root Cause

The root cause is the use of unsafe deserialization on data influenced by HTTP request parameters. The plugin trusts serialized input transmitted through form fields or integration hooks instead of validating it against a strict schema or using safe formats such as JSON.

Attack Vector

An attacker sends a crafted HTTP request to a WordPress endpoint exposed by the plugin. The serialized payload references existing PHP classes within WordPress core, plugins, or themes. When the payload is deserialized, gadget chains trigger unintended behavior such as arbitrary file operations or remote code execution.

The vulnerability mechanism is documented in the Patchstack WordPress Vulnerability Report. No public proof-of-concept exploit is currently available, and EPSS data indicates a low near-term exploitation probability at this time.

Detection Methods for CVE-2025-60180

Indicators of Compromise

HTTP POST requests to Gravity Forms endpoints containing serialized PHP payloads beginning with O:, a:, or s: patterns
Unexpected PHP errors referencing __wakeup, __destruct, or unserialize() in WordPress debug logs
New or modified PHP files in wp-content/uploads/ or plugin directories following form submissions
Outbound network connections from the WordPress host to unfamiliar destinations after form processing

Detection Strategies

Inspect web server access logs for requests targeting gf-salesforce-crmperks endpoints with unusually long or base64-encoded parameter values
Apply web application firewall rules that flag serialized PHP object signatures in request bodies
Monitor wp-content/plugins/gf-salesforce-crmperks/ for unauthorized file modifications and integrity changes

Monitoring Recommendations

Enable WordPress audit logging to track plugin configuration changes and form submission anomalies
Correlate Salesforce API call patterns with WordPress form events to identify unexpected automation
Alert on PHP process spawning shell utilities such as bash, sh, or wget from the web server user context

How to Mitigate CVE-2025-60180

Immediate Actions Required

Identify all WordPress installations running the WP Gravity Forms Salesforce plugin at version 1.5.1 or earlier
Restrict access to Gravity Forms endpoints behind authentication or IP allowlists until a patch is available
Review recent form submissions and Salesforce integration logs for signs of object injection attempts
Rotate any API tokens or credentials used by the plugin to communicate with Salesforce

Patch Information

At the time of publication, no fixed version has been confirmed in the available references. Administrators should monitor the Patchstack advisory and the CRM Perks vendor channels for an updated release beyond version 1.5.1.

Workarounds

Deactivate and remove the gf-salesforce-crmperks plugin if Salesforce integration is non-essential
Deploy WAF signatures that block serialized PHP payloads in form parameters
Restrict the WordPress PHP runtime with disable_functions to limit dangerous functions usable by gadget chains
Apply least-privilege filesystem permissions to wp-content/ to limit post-exploitation file writes

bash

# Configuration example: virtual patch via ModSecurity to block serialized PHP objects
SecRule ARGS "@rx (^|[&=])(O|a|s):\d+:\"" \
    "id:1060180,phase:2,deny,status:403,\
    msg:'Potential PHP Object Injection (CVE-2025-60180)',\
    tag:'CWE-502'"