CVE-2025-58636 CRITICAL

CVE-2025-58636: WordPress WP Gravity Forms Keap/Infusionsoft Plugin <= 1.2.3 - Deserialization of untrusted data Vulnerability

Vendor Crm Perks
Product WP Gravity Forms Keap/Infusionsoft
Weakness CWE-502 · Unsafe deserialization
Published November 6, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.

Key dates

02Disclosure timeline

November 6, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-35050 Newforma Info Exchange (NIX) .NET unauthenticated deserialization CVE-2023-36439 Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2024-4606 WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder plugin <= 2.0.3 - PHP Object Injection vulnerability CVE-2022-20763 Cisco Webex Meetings Java Deserialization Vulnerability CVE-2025-32571 WordPress TuriTop Booking System Plugin <= 1.0.10 - PHP Object Injection vulnerability