A vulnerability in the CRM Perks WP Gravity Forms Keap/Infusionsoft plugin allows a user to be redirected to an untrusted site. This flaw is categorized as CWE‑601, a web application weakness that can undermine user trust and potentially lead to credential theft through phishing. The CVSS score of 4.7 indicates moderate severity, largely due to the risk of misleading users rather than direct code execution.

The defect affects all releases of the WP Gravity Forms Keap/Infusionsoft plugin at or earlier than version 1.2.6, regardless of earlier or later sub‑releases, for all installations under the CRM Perks vendor umbrella.

With a CVSS of 4.7 and an EPSS of less than 1%, the likelihood of exploitation is low, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a crafted HTTP request that triggers the plugin’s redirect routine; an attacker may embed URLs that guide unsuspecting users to malicious or phishing sites. Exploitation requires the target to click the redirected link, and the impact is confined to the victim’s browser session and potential credential compromise.