The vulnerability CVE-2025-60091 affects the WP Gravity Forms Zoho CRM and Bigin plugin by allowing deserialization of untrusted data, which can lead to object injection attacks. This issue impacts versions up to and including 1.2.9. The vulnerability is remotely exploitable without privileges or user interaction, resulting in a critical severity rating with a CVSS 3.1 base score of 9.8. No vendor advisory or patch links are currently available, and the plugin is not a cloud service, so remediation depends on vendor patch release.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code, compromise data confidentiality, integrity, and availability within affected installations of the plugin. The critical CVSS score reflects the potential for full system compromise or data breach. However, no known active exploits have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.