CVE-2026-8174

Vulnerability

The Zoho Mail WordPress plugin versions before 1.6.2 are vulnerable to Cross-Site Request Forgery (CSRF) [1]. This flaw allows an attacker to trick an authenticated administrator into unknowingly executing unwanted actions on the plugin's settings or configuration pages.

Exploitation

Exploitation requires an authenticated administrator to visit a malicious page or click a crafted link while logged into WordPress. The attacker can forge requests to change plugin settings, such as the Zoho Mail API credentials or email configuration, without the administrator's consent. No additional authentication or network position is required beyond the victim's session.

Impact

Successful CSRF exploitation can lead to unauthorized modification of the plugin's configuration, potentially redirecting outgoing emails to an attacker-controlled account or disrupting email delivery. This compromises the integrity and confidentiality of email communications from the WordPress site.

Mitigation

The vulnerability is fixed in version 1.6.2 of the Zoho Mail WordPress plugin [1]. Users should update to this version or later. No workarounds are documented in the available references.