CVE-2025-60180: 
WordPress vulnerability analysis and mitigation

CVE-2025-60180 is a PHP Object Injection vulnerability (Deserialization of Untrusted Data) in the CRM Perks WP Gravity Forms Salesforce WordPress plugin (gf-salesforce-crmperks). It affects all plugin versions up to and including 1.5.1, with version 1.5.2 containing the fix. The vulnerability was reported by researcher Phat RiO on July 9, 2025, and published by Patchstack on August 8, 2025. It carries a CVSS v3.1 base score of 9.8 (Critical), requiring no authentication or user interaction to exploit (Patchstack).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), which enables PHP Object Injection (CAPEC-586). When the plugin deserializes attacker-controlled input without proper validation, a malicious actor can craft a serialized PHP object that, when processed, triggers a Property-Oriented Programming (POP) chain present in the WordPress environment. Exploitation requires no authentication and is achievable remotely over the network with low attack complexity. If a suitable POP chain exists in the installed PHP codebase, this can lead to code injection, SQL injection, path traversal, or denial of service (Patchstack).

Successful exploitation can result in full compromise of the affected WordPress site, including unauthorized remote code execution, SQL injection, path traversal, and denial of service — contingent on the availability of a suitable POP chain in the target environment. Confidentiality, integrity, and availability are all rated as HIGH impact, meaning an attacker could exfiltrate sensitive data, manipulate site content or databases, and render the site unavailable. Given the unauthenticated attack vector, mass-exploit campaigns targeting thousands of WordPress sites simultaneously are a realistic threat (Patchstack).

As of the time of publication, there is no known public proof-of-concept exploit and no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.024%, reflecting a currently low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack rates it as high priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns against WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP Gravity Forms Salesforce plugin (versions ≤ 1.5.1) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata (e.g., /wp-content/plugins/gf-salesforce-crmperks/readme.txt).
2. Identify deserialization endpoint: Locate the plugin's functionality that accepts and deserializes user-supplied data — typically a form submission or API callback endpoint exposed by the plugin.
3. Craft malicious serialized payload: Construct a PHP serialized object that targets a POP chain available in the WordPress installation (e.g., leveraging classes from WordPress core, Gravity Forms, or other installed plugins/themes) to achieve the desired effect (RCE, file write, etc.).
4. Submit payload: Send the crafted serialized object to the vulnerable endpoint via an unauthenticated HTTP request (no credentials required).
5. Trigger POP chain: The plugin deserializes the malicious object, invoking magic methods (__wakeup, __destruct, etc.) that execute the POP chain, resulting in code execution, data exfiltration, or other malicious outcomes (Patchstack).

• Network: Unexpected or malformed POST requests to plugin-related endpoints (e.g., endpoints associated with gf-salesforce-crmperks) containing serialized PHP data (O:<length>:"<classname>" patterns in request bodies.
• Logs: WordPress or web server access logs showing unusual requests to Gravity Forms Salesforce plugin endpoints from unknown or automated IP addresses; PHP error logs referencing unexpected class instantiation or magic method calls.
• File System: Newly created or modified PHP files in the WordPress installation directory (e.g., web shells in wp-content/uploads/ or plugin directories); unexpected changes to wp-config.php or .htaccess.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) indicating command execution via deserialization.
• Database: Unexpected new WordPress admin accounts, modified user roles, or injected malicious content in the database.

The primary remediation is to update the WP Gravity Forms Salesforce plugin to version 1.5.2 or later, which contains the patch for this vulnerability. If an immediate update is not possible, consider temporarily deactivating the plugin to eliminate the attack surface. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploitation attempts until the plugin is updated. Additional hardening measures include implementing a Web Application Firewall (WAF), restricting plugin permissions, and monitoring for suspicious activity (Patchstack).

The vulnerability was discovered and disclosed by security researcher Phat RiO through Patchstack's responsible disclosure process. Patchstack has classified it as high priority and issued a virtual mitigation rule for its users, noting that PHP Object Injection vulnerabilities of this severity are commonly leveraged in mass WordPress exploit campaigns. No significant broader media coverage or notable social media discussion has been identified at this time (Patchstack).