{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8479", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-01T17:25:16.494Z", "datePublished": "2025-09-11T06:43:51.174Z", "dateUpdated": "2026-04-08T16:45:20.935Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:20.935Z"}, "affected": [{"vendor": "zohoflow", "product": "Zoho Flow \u2013 Integrate 100+ plugins with 1000+ business apps, no-code workflow automation", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.14.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho_flow_deactivate_plugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Zoho Flow <= 2.14.1 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/328fc7a9-be41-4e30-bb8d-c12ac3fd63f5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.1/settings.php#L151"}, {"url": "https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.1/settings.php#L144"}, {"url": "https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.2/settings.php#L144"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "timeline": [{"time": "2025-09-10T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:25:47.981875Z", "id": "CVE-2025-8479", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:41:53.922Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8479", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T14:25:47.981875Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:25:50.399Z"}}], "cna": {"title": "Zoho Flow <= 2.14.1 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "zohoflow", "product": "Zoho Flow \u2013 Integrate 100+ plugins with 1000+ business apps, no-code workflow automation", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.14.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-10T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/328fc7a9-be41-4e30-bb8d-c12ac3fd63f5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.1/settings.php#L151"}, {"url": "https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.1/settings.php#L144"}, {"url": "https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.2/settings.php#L144"}], "descriptions": [{"lang": "en", "value": "The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho_flow_deactivate_plugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-11T06:43:51.174Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8479", "state": "PUBLISHED", "dateUpdated": "2025-09-11T14:41:53.922Z", "dateReserved": "2025-08-01T17:25:16.494Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-11T06:43:51.174Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho_flow_deactivate_plugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-8479", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-11T07:15:31.200", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.1/settings.php#L144"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.1/settings.php#L151"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/zoho-flow/tags/2.14.2/settings.php#L144"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/328fc7a9-be41-4e30-bb8d-c12ac3fd63f5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:51:00.330660+00:00", "value": {"mitigation_remediation": ["Update the Zoho Flow WordPress plugin to version 2.14.2 or newer.", "Enable and configure a WordPress security plugin that validates nonces and checks CSRF tokens for all plugin\u2011related actions.", "Restrict administrative access to essential personnel, enforce two\u2011factor authentication, and apply the principle of least privilege to reduce the potential impact of forged requests."], "summary": {"action": "Update Plugin", "impact": "Modify site typography settings via CSRF"}, "threat_synthesis": {"affected_systems": "The affected component is the Zoho Flow plugin for WordPress. Versions up to and including 2.14.1 are impacted. Administrators who have super\u2011user privileges to the WordPress site must be tricked into clicking a malicious link.", "description_and_impact": "A Cross\u2011Site Request Forgery vulnerability exists in the Zoho Flow WordPress plugin for versions up to 2.14.1. The vulnerability stems from missing or incorrect nonce validation in the zoho_flow_deactivate_plugin function. An attacker who can craft a forged request and trick a site administrator into clicking a link could change typography settings on a site, thereby tampering with the site\u2019s visual presentation and possibly its user experience.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack likely requires a social engineering effort to get an administrator to click a malicious link, after which the attacker can modify typography settings without any further authentication."}}}}, "created": "2025-09-12T08:02:58.968483+00:00", "updated": "2026-04-22T01:00:04.359027+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}