CVE-2025-8593

The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a missing capability check on the 'install_plugin' function. This makes it possible for authenticated attackers, with subscriber-level access and above to install plugins on the target site and potentially achieve arbitrary code execution on the server under certain conditions.

• CWE-862

• https://plugins.trac.wordpress.org/browser/gsheetconnector-gravity-forms/tags/1.3.23/includes/class-gravityform-gs-service.php#L128
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3354113%40gsheetconnector-gravity-forms&new=3354113%40gsheetconnector-gravity-forms&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c7266ce6-2853-4c5d-9e36-8c5b7418b072?source=cve

Published

Oct 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-8587Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2025-8588The Gutenberg Blocks – PublishPress Blocks plugin for WordPr…6.4
• CVE-2025-8589Improper Neutralization of Input During Web Page Generation …7.6
• CVE-2025-8590Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2025-8591The software accepts user-supplied input via a URL parameter…6.1
• CVE-2025-8592The Inspiro theme for WordPress is vulnerable to Cross-Site …8.1
• CVE-2025-8594The Pz-LinkCard WordPress plugin before 2.5.7 does not valid…3.8
• CVE-2025-8595The Zakra theme for WordPress is vulnerable to unauthorized …4.3
• CVE-2025-8597MacVim's configuration on macOS, specifically the presence o…4.8
• CVE-2025-8603The Unlimited Elements For Elementor plugin for WordPress is…6.4
• CVE-2025-8604The WP Table Builder – WordPress Table Plugin plugin for Wor…6.4
• CVE-2025-8605The Gutenify – Visual Site Builder Blocks & Site Templates. …6.4