title: Gravity Forms Google Sheet Connector < 1.3.5 - Access Code Update via CSRF
description: The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
vendor: Unknown
product: Gravity Forms Google Sheet Connector
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.3.5
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}
{
vendor: Unknown
product: gsheetconnector-gravityforms-pro
versions:
status: affected, versionType: custom, version: 0, lessThanOrEqual: 1.3.5
defaultStatus: affected
}
