CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-31408 – WordPress Zoho Flow plugin <= 2.13.3 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2025-31408
01 Apr 2025 — Missing Authorization vulnerability in Zoho Flow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho Flow: from n/a through 2.13.3. The Zoho Flow – Integrate 100+ plugins with 1000+ business apps, no-code workflow automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with Subscriber-level access and above,... • https://patchstack.com/database/wordpress/plugin/zoho-flow/vulnerability/wordpress-zoho-flow-plugin-2-13-3-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47334 – WordPress Zoho Flow for WordPress plugin <= 2.7.1 - SQL Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-47334
26 Sep 2024 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Flow Zoho Flow for WordPress allows SQL Injection.This issue affects Zoho Flow for WordPress: from n/a through 2.7.1. The Zoho Flow for WordPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated atta... • https://patchstack.com/database/vulnerability/zoho-flow/wordpress-zoho-flow-plugin-2-7-1-sql-injection-vulnerability?_s_id=cve • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •