CVE-2025-59568

MediumCVSS 4.3

Published: 22/09/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The Zoho Flow WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 2.14.1. This may allow an attacker to force unintended actions on behalf of an authenticated user.

Risk Assessment

An attacker could trick an administrator into performing unintended actions, potentially leading to configuration changes or other impacts depending on plugin functionality.

Recommendation

Update the Zoho Flow plugin to a version later than 2.14.1. Consider disabling the plugin until updated.

Other vulnerabilities in Zoho Flow

CVE-2026-62131Critical
Zoho Flow versions up to and including 2.14.5 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in Zoho Flow Zoho Flow zoho-flow allows Cross Site Request Forgery.This issue affects Zoho Flow: from n/a through <= 2.14.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS