The Zoho Flow WordPress plugin suffers from a CSRF vulnerability (CWE-352) due to improper nonce validation on the zoho_flow_deactivate_plugin function. This enables attackers to craft malicious requests that, if executed by an authenticated administrator, can alter typography settings without proper authorization. The vulnerability affects all versions up to 2.14.1. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, no privileges required, and user interaction needed. No patch or remediation details have been provided by the vendor, and the plugin is not a cloud service, so remediation depends on plugin updates.

An attacker can cause an authenticated site administrator to unknowingly perform actions that modify typography settings via a forged request. This impacts the integrity of the affected WordPress site’s configuration but does not affect confidentiality or availability. The vulnerability requires user interaction (administrator clicking a link) and does not allow remote code execution or data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring for plugin updates from Zoho Flow is recommended to apply any forthcoming patches addressing this vulnerability.