Zoho Mail Plugin CVE-2026-8174

The target WordPress site must have the Zoho Mail plugin installed and active at a version below 1.6.2. Per CVSS PR:L, the victim must hold at least a low-privilege WordPress account (e.g., subscriber or contributor) and must be actively authenticated when the forged request is submitted. Per CVSS UI:R, the victim must visit or interact with an attacker-controlled page or resource - exploitation cannot occur passively or automatically without this step. The attacker does not require any WordPress account or prior access to the target site. Limiting factors: the mandatory user interaction step makes mass exploitation non-automatable (confirmed by SSVC: Automatable: no); impact is scoped exclusively to integrity (no credential theft or service disruption); and the specific plugin feature or admin endpoint vulnerable to CSRF is not identified in available data, requiring code-level review of versions prior to 1.6.2 to enumerate the full attack surface.

The CVSS 5.7 medium score (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) identifies this as a network-accessible, low-complexity vulnerability with a meaningful real-world constraint: victim interaction (UI:R) is mandatory, meaning exploitation cannot succeed without social engineering a logged-in WordPress user into visiting a malicious page. EPSS at 0.01% (1st percentile) is exceptionally low and consistent with SSVC's classification of exploitation as none and automatable as no. This is not a high-urgency emergency - the attack is not weaponizable at scale, not listed in CISA KEV, and carries no confidentiality or availability risk. The primary real-world concern is targeted abuse against specific site administrators or users. The integrity impact is rated high, so a successful attack could alter mail configuration or plugin behavior, but the limiter of required user interaction substantially reduces the practical blast radius compared to a PR:N/UI:N vulnerability of similar CVSS severity.

An attacker crafts a malicious webpage containing a hidden HTML form or auto-submitting JavaScript that targets a state-changing endpoint in the Zoho Mail WordPress plugin - such as modifying SMTP credentials or mail routing settings. The attacker then lures an authenticated WordPress user (e.g., via phishing or a compromised comment/forum link) to visit the page, causing the victim's browser to silently submit the forged request with their active session cookie, changing plugin configuration without any visible indication to the victim. No public exploit code has been identified at time of analysis, and successful exploitation requires precise targeting of a logged-in session.