Critical vulnerability in Zoho Flow plugin for WordPress

WordPress

What happened

There is a serious vulnerability related to unauthenticated PHP object injection in specific versions of the Zoho Flow plugin for WordPress.

Are you affected?

Users of the Zoho Flow plugin for WordPress, specifically versions 2.14.5 and earlier, may be affected.

What to do now

1. Upgrade to a version that addresses the vulnerability or install a patch if available.
2. Monitor the official advisory for updates on fixed versions.
3. Consider reviewing access controls and user permissions for added security.

Sources

• cve.now/CVE-2026-62131
• cve.now/GHSA-6pvh-h9mv-qrhc
• CVE-2026-62131
• GHSA-6pvh-h9mv-qrhc
• https://nvd.nist.gov/vuln/detail/CVE-2026-62131
• https://patchstack.com/database/wordpress/plugin/zoho-flow/vulnerability/wordpress-zoho-flow-plugin-2-14-5-php-object-injection-vulnerability?_s_id=cve
• cve.now/GHSA-6PVH-H9MV-QRHC
• GHSA-6PVH-H9MV-QRHC

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.