CVE-2025-8479: Zoho Flow <= 2.14.1 - Cross-Site Request Forgery
The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zohoflowdeactivateplugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8479?
CVE-2025-8479 has been classified as a medium severity vulnerability due to its potential for Cross-Site Request Forgery.
How do I fix CVE-2025-8479?
You can fix CVE-2025-8479 by updating the Zoho Flow plugin to version 2.14.2 or later, which includes the necessary nonce validation.
What versions of the Zoho Flow plugin are affected by CVE-2025-8479?
CVE-2025-8479 affects all versions of the Zoho Flow plugin up to and including 2.14.1.
Can CVE-2025-8479 be exploited by authenticated users?
No, CVE-2025-8479 can be exploited by unauthenticated attackers due to the lack of proper nonce validation.
What type of attack is associated with CVE-2025-8479?
CVE-2025-8479 is associated with Cross-Site Request Forgery (CSRF) attacks, allowing unauthorized changes to the plugin state.