CVE-2025-8479

Name of the Vulnerable Software and Affected Versions Zoho Flow plugin for WordPress versions prior to 2.14.2

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the zoho flow deactivate plugin() function. This allows unauthenticated attackers to modify typography settings by tricking a site administrator into clicking a malicious link.

Recommendations Update the plugin to a version newer than 2.14.1. As a temporary mitigation, restrict administrative access to the plugin settings.