GSheetConnector For Gravity Forms WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the GSheetConnector For Gravity Forms WordPress plugin, affecting versions through 1.3.23. The issue arises from inadequate nonce validation in the 'activate_plugin' and 'deactivate_plugin' functions. This vulnerability allows attackers to manipulate authenticated administrators into activating or deactivating plugins by sending forged requests, such as through malicious links or compromised pages.

Impact

Exploitation of this vulnerability could lead to unauthorized activation or deactivation of plugins by authenticated administrators.

Remediation

Users can update to version 1.3.24 or a newer patched version to address this vulnerability.