CVE-2025-47456

WordPress WP Gravity Forms Zendesk plugin <= 1.1.2 - Open Redirection Vulnerability

Published May 7, 2025 CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk gf-zendesk allows Phishing.This issue affects WP Gravity Forms Zendesk: from n/a through <= 1.1.2.

Analysis

Technical impact

The WP Gravity Forms Zendesk plugin contains an open redirect flaw that allows attackers to craft URLs which redirect visitors to malicious sites, facilitating phishing campaigns. This flaw stems from inadequate validation of redirect targets, identified as CWE‑601. The vulnerability lacks direct impact on data confidentiality or integrity but can undermine user trust and facilitate credential theft.

Affected Systems

The issue affects the WP Gravity Forms Zendesk plugin from its first release through version 1.1.2, released by CRM Perks. Any WordPress installation using this plugin within that version range is relevant.

Risk and Exploitability

With a CVSS score of 4.7 the risk is moderate, yet the EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is a user clicking a manipulated link constructed with the plugin’s redirect parameter, which is inferred from the description of the open redirect flaw.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

CRM Perks

WP Gravity Forms Zendesk

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.1.2

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the WP Gravity Forms Zendesk plugin to version 1.1.3 or later where the redirect issue is fixed
If an update is unavailable, disable or remove the redirect feature of the plugin or uninstall the plugin entirely
Implement site‑wide redirect filtering or use a security plugin that blocks unexpected redirections to unknown domains

Generated by OpenCVE AI on April 30, 2026 at 20:41 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-13857	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk allows Phishing. This issue affects WP Gravity Forms Zendesk: from n/a through 1.1.2.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.328% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/gf-zendesk/vulnerability/wordpress-wp-gravity-forms-zendesk-1-1-2-open-redirection-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'}`

Apr 1, 2026 11:45 PM Description updated. Title updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk allows Phishing. This issue affects WP Gravity Forms Zendesk: from n/a through 1.1.2.	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk gf-zendesk allows Phishing.This issue affects WP Gravity Forms Zendesk: from n/a through <= 1.1.2.
Title	WordPress WP Gravity Forms Zendesk <= 1.1.2 - Open Redirection Vulnerability	WordPress WP Gravity Forms Zendesk plugin <= 1.1.2 - Open Redirection Vulnerability
References	https://patchstack.com/database/wordpress/plugin/gf-zendesk/vulnerability/wordpress-wp-gravity-forms-zendesk-1-1-2-open-redirection-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/gf-zendesk/vulnerability/wordpress-wp-gravity-forms-zendesk-1-1-2-open-redirection-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'}`

Jul 14, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00033}`	epss `{'score': 0.00038}`

May 7, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 7, 2025 2:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk allows Phishing. This issue affects WP Gravity Forms Zendesk: from n/a through 1.1.2.
Title		WordPress WP Gravity Forms Zendesk <= 1.1.2 - Open Redirection Vulnerability
Weaknesses		CWE-601
References		https://patchstack.com/database/wordpress/plugin/gf-zendesk/vulnerability/wordpress-wp-gravity-forms-zendesk-1-1-2-open-redirection-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'}`