The vulnerability arises from a missing capability check in the plugin’s install_plugin function, which allows attackers who possess any WordPress role of Subscriber or higher to install and activate arbitrary plugins on the site. This bypass can lead to arbitrary code execution or other compromise when a malicious plugin is installed. The weakness is formally classified as CWE‑862.

WordPress sites running the GSheetConnector for Gravity Forms plugin from Western Deal with a version of 1.3.27 or earlier are impacted. Newer releases (1.3.28 and later) contain the fix.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1 % suggests that, while the flaw is powerful, exploitation is still considered unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need legitimate login credentials with Subscriber level or higher; the exploit requires only the ability to trigger the install_plugin routine, after which a malicious plugin can be added and executed on the server.