CVE-2025-58636

Name of the Vulnerable Software and Affected Versions WP Gravity Forms Keap/Infusionsoft versions prior to 1.2.4

Description The plugin is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The impact of this issue depends on the presence of a POP (Property Oriented Programming) chain—a sequence of gadgets used to execute arbitrary code—within other installed plugins or themes. If such a chain exists, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations Update the plugin to a version newer than 1.2.3.