The CRM Perks Connector for Gravity Forms and Google Sheets plugin (version <= 1.2.4) contains a CSRF vulnerability that could allow attackers to trick authenticated users into submitting unauthorized requests. This vulnerability does not require privileges (PR:N) but does require user interaction (UI:R). The attack vector is network-based (AV:N), with low attack complexity (AC:L). The vulnerability impacts integrity and availability but not confidentiality, as indicated by the CVSS vector.

Successful exploitation could lead to limited integrity and availability impacts within the affected plugin's context, potentially causing unauthorized actions to be performed without the user's consent. There is no indication of confidentiality impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted sites while authenticated to the affected plugin. Monitor vendor channels for updates regarding patches or official mitigations.