This vulnerability involves unsafe deserialization of untrusted data in the WP Gravity Forms Salesforce plugin by CRM Perks, allowing object injection attacks. It affects all versions up to and including 1.5.1. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. The product is a cloud service, so the vendor is responsible for applying patches and mitigating the issue on their infrastructure.

Successful exploitation can lead to complete compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score and the nature of object injection via deserialization, attackers could execute arbitrary code or manipulate data. However, no active exploits have been reported in the wild so far.

A patch is available for this vulnerability. Since WP Gravity Forms Salesforce is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that the service has been updated to address this issue. No additional user action is required if the vendor confirms patch deployment.