The GSheetConnector for Gravity Forms plugin is vulnerable to Cross‑Site Request Forgery because activate_plugin and deactivate_plugin functions do not correctly validate the nonce. An attacker can craft a malicious link or embed a forged request on a compromised page that, when clicked by an authenticated administrator, triggers the activation or deactivation of any plugin. This allows the attacker to enable a malicious plugin or disable a security plugin, effectively elevating privileges and potentially executing arbitrary code on the WordPress site.

Westendeal’s GSheetConnector for Gravity Forms – Send Gravity Forms Entries to Google Sheets in Real‑Time is affected for all releases up to and including version 1.3.23. The plugin is a WordPress add‑on that integrates Gravity Forms with Google Sheets.

The CVSS score of 2.4 indicates low overall severity, and the EPSS score of <1% shows a very low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to lure an authenticated administrator to an attacker‑controlled URL in order to win a CSRF attack; it is not remotely exploitable by unauthenticated actors. While the risk is low, the potential for privilege escalation makes it a concern for sites with sensitive data.