The plugin Address Autocomplete via Google for Gravity Forms contains a Cross‑Site Request Forgery vulnerability that allows an attacker to submit forged requests on behalf of an authenticated user. An attacker could trigger the plugin’s internal state changes or actions that are normally protected by authentication, potentially modifying form behavior or other configuration settings.

All installations of the PluginsCafe Address Autocomplete via Google for Gravity Forms version 1.3.4 or earlier are affected. Administrators and privileged users who execute the plugin’s actions while logged in on any WordPress site are at risk.

With a CVSS score of 5.4, the severity is moderate. The EPSS score of < 1% indicates that the probability of exploitation is low. As it is not listed in the CISA KEV catalog, no public exploit data is currently confirmed. The likely attack vector requires a victim with an authenticated session to visit a malicious page that sends a crafted request to the plugin’s endpoint.