CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.9.
Explanation of Vulnerability in Simple Terms
The WP Gravity Forms Zoho CRM and Bigin plugin through version 1.2.9 deserializes untrusted data without validation, allowing an attacker to execute arbitrary PHP code on the site. No authentication or user interaction is required. This affects all installations of the plugin up to and including version 1.2.9.
What an attacker can do
Run arbitrary PHP code on the site and take complete control of it.
Potential impact on your site
Complete compromise of the WordPress site, including data theft, malware installation, and site defacement.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
