A Cross-Site Request Forgery (CSRF) vulnerability in the Zoho ZeptoMail WordPress plugin enables unauthenticated attackers to execute Stored Cross-Site Scripting (XSS) attacks.

The vulnerability exists due to improper CSRF protection, which allows an unauthenticated attacker to trick an administrator into performing actions that result in the injection of malicious scripts into the application. This Stored XSS condition can lead to unauthorized script execution within the context of the user session.

Successful exploitation of this vulnerability can lead to unauthorized actions performed on behalf of an authenticated administrator, potentially compromising the integrity and security of the WordPress installation. Given the CVSS score of 7.1, this flaw presents a High risk, as it may lead to session hijacking, defacement, or the execution of arbitrary administrative tasks by an unauthorized party.

Immediate Action: Update the Zoho ZeptoMail plugin to the latest available version beyond 3.3.1 to ensure the CSRF protections are correctly implemented.

Proactive Monitoring: Review web server and application logs for unusual administrative activities or suspicious requests originating from unauthorized sources.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common CSRF and XSS attack patterns until the software can be patched.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability, combined with the potential for Stored XSS, necessitates immediate attention from administrators. Organizations utilizing the Zoho ZeptoMail plugin should verify their current version and apply the vendor-provided security updates as the primary method of remediation to prevent potential account compromise.