Is CVE-2026-8174 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8174 being exploited in the wild.

How severe is CVE-2026-8174?

Medium severity, with a CVSS score of 5.7, published 26 May 2026.

Which products and versions are affected?

Zoho Corporation Mail for WordPress before 1.6.2.

Is there a fix for CVE-2026-8174?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8174 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8174?

Check whether you run Zoho Corporation Mail for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8174: Zohocorp Zoho Mail CSRF in WordPress plugin

CVE-2026-8174 · Severity: medium · CVSS 5.7 · Published 2026-05-26

The Zoho Mail plugin for WordPress, which allows websites to send emails via Zoho's secure API, is vulnerable to a security flaw that could allow an attacker to trick an administrator into performing unintended actions. If an attacker successfully exploits this vulnerability, they could potentially modify the plugin's configuration, such as changing the sender's email address or API credentials. This could lead to unauthorized email delivery or disruption of the website's communication services.

Vendors: Zoho Corporation.

Quick answers

Is CVE-2026-8174 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8174 being exploited in the wild.
How severe is CVE-2026-8174?: Medium severity, with a CVSS score of 5.7, published 26 May 2026.
Which products and versions are affected?: Zoho Corporation Mail for WordPress before 1.6.2.
Is there a fix for CVE-2026-8174?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8174 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8174?: Check whether you run Zoho Corporation Mail for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Zohocorp Zoho Mail WordPress plugin before version 1.6.2. The vulnerability stems from insufficient validation of request origins on administrative actions within the plugin's configuration pages. An attacker can exploit this by inducing a logged-in administrator to visit a malicious website or click a crafted link, leading to unauthorized changes in plugin settings such as OAuth 2.0 credentials, 'From' email addresses, or mail server regions. The attack requires network connectivity and user interaction from an authenticated user. The issue is resolved in version 1.6.2.

Affected products

Zohocorp Zoho Mail for WordPress before 1.6.2

Timeline

2026-05-26: advisory: CVE-2026-8174 published by NVD/ManageEngine

References

https://wordpress.org/plugins/zoho-mail/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.