CVE-2025-8593: The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a…

PriorityP259high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.39%

31.0th percentile

The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a missing capability check on the 'install_plugin' function. This makes it possible for authenticated attackers, with subscriber-level access and above to install plugins on the target site and potentially achieve arbitrary code execution on the server under certain conditions.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
westerndeal	gsheetconnector_for_gravity_forms_send_gravity_forms_entries_to_google_sheets_in	<= 1.3.27	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.