Connector for Gravity Forms and Google Sheets

Hi,

I wanted to bring to your attention that a PHP Object Injection vulnerability has been reported for your plugin “Connector for Gravity Forms and Google Sheets”.

Details:

• Vulnerability Type: PHP Object Injection
• Detected On: August 8, 2025
• Affected Versions: ≤ 1.2.5
• Current Status: No fix or update package available
  

This issue was flagged by a website security scanner, which recommends addressing the vulnerability as soon as possible to prevent potential exploitation.

Could you please confirm if there’s an upcoming patch or workaround available to mitigate this risk?

Thank you for your attention to this matter.

Best regards,
Joevil

Patchstack Report Reference:

https://patchstack.com/database/wordpress/plugin/wp-gravity-forms-spreadsheets/vulnerability/wordpress-connector-for-gravity-forms-and-google-sheets-plugin-1-2-5-php-object-injection-vulnerability

• This topic was modified 5 months, 2 weeks ago by joevil1984.
• This topic was modified 5 months, 2 weeks ago by Yui.

Solves a very specific use case for consolidating leads into a single location. I found it ok to setup all be it with a rather complex Google Workspace setup, which to be fair probably isn’t the plugin developers fault but still causes friction in the setup process.

I wanted to love this plugin but there were a few glaring bugs for me right off the bat that make me want to look for an alternative.

1. The list of sheets when you try to attach them doesn’t show everything if you have an account with a lot of them. There’s no way to filter or search for a specific sheet which makes usability of the plugin pretty awful.
2. I tried working around the above issue by renaming the sheet after it had being paired as I assumed these were linked by the Sheet ID not specifically the name of the sheet. This wiped out all the form settings and all of the field mappings and disconnected the sheet from the site
3. If you remove (or rename) a header from the sheet and refresh the fields all the other field mappings move to a totally different field and everything from that point needs relinking.

Again I think it solves the need but there are some glaring bugs here which just make it difficult to work with and handle. I’m currently only using the free version of the plugin but my poor experience and low amount of requirements make me not want to touch this plugin again.

All works really well and does exactly what it says on the tin, and when I had an issue (of my own making) support were quick to advise a solution.

The functionality of this plugin works great. I get notified if there are ever any syncing issues, and I can resend the sync easily. To be clear, most sync issues come from resource limitations when we have multiple team members adding hundreds of entries within an hour, so its a hosting limitation, not a plugin limitation

No phone number fields, on file upload fields, very large red bar in between plugins just below it to advertise the premium version. Very intrusive.