CVE-2025-8606 describes a CSRF vulnerability in the GSheetConnector for Gravity Forms WordPress plugin (versions ≤ 1.3.23). The issue arises from missing or incorrect nonce validation in the activate_plugin and deactivate_plugin functions, enabling attackers to induce authenticated administrators to perform unintended plugin activation or deactivation actions through crafted requests. The vulnerability has a CVSS 3.1 base score of 2.4, reflecting low severity with limited impact on integrity and no impact on confidentiality or availability. No vendor advisory or patch information is provided, and no exploits are known in the wild.

Successful exploitation could allow an attacker to cause an authenticated administrator to activate or deactivate plugins without their intent, potentially altering the WordPress environment's functionality. The impact is limited to integrity with no direct confidentiality or availability effects. Given the low CVSS score and requirement for administrator privileges and user interaction, the overall risk is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when clicking on links or visiting untrusted sites while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security channels is recommended.