A flaw in the CRM Perks WP Gravity Forms Salesforce plugin allows attackers to craft URLs that redirect users to arbitrary, untrusted sites. This open redirect can be exploited to deliver phishing or malware payloads by convincing users that they are being directed to legitimate sites. The weakness is an improper validation of redirect destinations, consistent with CWE‑601, and results in a moderate security impact.

The vulnerability affects the WP Gravity Forms Salesforce plugin, released by CRM Perks. Versions from the earliest released build up to and including 1.4.7 are affected. Any WordPress site that has the plugin installed within this version range is at risk.

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of < 1% suggests a low likelihood of exploitation in the wild. The issue is not listed in CISA KEV, implying no confirmed widespread exploitation. Attackers would need to embed a malicious link that exploits the redirect logic, likely as part of a phishing campaign. The vulnerability is exploitable via user interaction with the redirected link; no local privilege escalation or remote code execution is possible.