The Zoho Mail WordPress plugin contains a Cross‑Site Request Forgery (CSRF) vulnerability affecting all releases older than 1.6.2. The weakness, identified as CWE‑352, allows an attacker to embed specially crafted requests into a webpage that a logged‑in user will unknowingly submit. Based on the description, it is inferred that an attacker could compel the user’s browser to perform mail‑related actions—such as modifying account settings or sending emails—without the user’s consent. The impact is that an authenticated WordPress user could unintentionally alter sensitive mail settings or trigger spam‑like messages.

WordPress sites that have installed Zoho Corp’s Zoho Mail WordPress plugin and are running a version earlier than 1.6.2 are affected. These installations may coexist with other plugins or themes, but the vulnerability resides solely in the plugin’s request handling logic.

The CVSS score of 5.7 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation to date. The likely attack vector is a CSRF attack launched through a malicious website or deceptive link that forces the victim’s authenticated browser to send a request to the plugin’s endpoints. The flaw does not provide code execution or unauthenticated access; it requires the victim to already be logged into WordPress and to have the plugin enabled.