What is the CVSS score of EUVD-2026-31811?

EUVD-2026-31811 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-31811?

Yes, a patch is available for EUVD-2026-31811. Update the affected software to the latest version immediately.

Zoho Mail Plugin EUVD-2026-31811

| CVE-2026-8174 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-26 Zohocorp

GHSA-v8jj-mm9h-g7fp

CSRF Zoho WordPress Zoho Mail Wordpress Plugin

5.7

CVSS 3.1 · Vendor: Zohocorp

Severity by source

Vendor (Zohocorp) PRIMARY

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Primary rating from Vendor (Zohocorp) · only source for this CVE.

CVSS VectorVendor: Zohocorp

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:19 vuln.today

Patch available

May 26, 2026 - 15:01 EUVD

CVE Published

May 26, 2026 - 11:04 nvd

MEDIUM 5.7

DescriptionCVE.org

Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF).

This issue affects Zoho Mail wordpress plugin versions before 1.6.2.

AnalysisAI

Cross-site request forgery in the Zoho Mail WordPress plugin (all versions before 1.6.2) enables a remote attacker to perform unauthorized, integrity-impacting actions on behalf of an authenticated WordPress user without their knowledge. The CVSS 5.7 medium score reflects high integrity impact with no confidentiality or availability exposure, requiring low-privilege victim authentication and user interaction. No public exploit code exists and no active exploitation has been identified; EPSS sits at the 1st percentile and SSVC classifies exploitation status as none.

Technical ContextAI

CSRF (CWE-352) exploits the browser's automatic inclusion of session credentials in cross-origin requests, allowing an attacker-controlled page to forge authenticated requests to a target application. In WordPress plugins, this class of vulnerability typically manifests as a missing or improperly validated nonce - WordPress's built-in anti-CSRF token mechanism required on all state-changing actions. The CPE string cpe:2.3:a:zohocorp:zoho_mail_wordpress_plugin:*:*:*:*:*:*:*:* covers all published versions of the Zohocorp-developed Zoho Mail plugin through 1.6.1, indicating the flaw is present across the plugin's full release history prior to the fix. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:U confirms the attack is network-reachable, low-complexity, but constrained by the need for victim interaction.

RemediationAI

Upgrade the Zoho Mail WordPress plugin to version 1.6.2 or later, which contains the vendor-released patch for this CSRF vulnerability; the update is available through the WordPress plugin repository at https://wordpress.org/plugins/zoho-mail/#developers and can be applied directly from the WordPress admin dashboard under Plugins > Updates. If an immediate upgrade is not feasible, restrict access to the WordPress admin dashboard via IP allowlisting at the server or WAF layer, which limits the set of users who can be targeted by forged admin-scoped requests - note this does not eliminate risk if the vulnerable plugin action is also accessible to subscriber-level users. Additionally, enforcing a strict Content-Security-Policy (CSP) header with a limited frame-ancestors directive can reduce cross-origin form submission risk, but this is a partial compensating control, not a substitute for patching. No patch version beyond 1.6.2 is referenced in available data; verify the current release on the plugin repository.