CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.
Explanation of Vulnerability in Simple Terms
The PDF for Gravity Forms plugin versions up to 6.5.0 contain a deserialization vulnerability in untrusted data handling. An authenticated attacker with low privileges can exploit this to read sensitive data, modify site content, or disrupt service. The attack requires specific conditions but does not need user interaction. Update immediately to a version newer than 6.5.0.
What an attacker can do
Read sensitive data, modify site content, or crash the site by sending a specially crafted request.
Potential impact on your site
Confidential data exposure, unauthorized content changes, or service disruption on sites running affected versions.
Conditions required to exploit
Attacker must have a low-privilege user account; no user interaction required.
Key dates
External resources
Related vulnerabilities
