The WP Gravity Forms Dynamics CRM plugin by CRM Perks contains an open redirect vulnerability (CVE-2025-47454) in versions up to 1.1.4. This vulnerability allows attackers to redirect users to arbitrary external URLs via crafted links, which can be used in phishing campaigns. The vulnerability is remotely exploitable without privileges but requires user interaction. The CVSS 3.1 base score is 4.7 (medium severity), reflecting limited confidentiality impact and no integrity or availability impact. No patch or vendor advisory has been provided as of the publication date.

Successful exploitation of this vulnerability can lead to users being redirected to malicious websites, increasing the risk of phishing attacks. There is no direct impact on data confidentiality, integrity, or availability of the affected system itself. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with URLs involving this plugin and consider implementing web application firewall (WAF) rules to detect and block suspicious redirects related to this plugin. Monitor vendor channels for updates and apply patches promptly when available.