CVE-2025-62873: CSRF in WP Flashy Marketing Automation

A successful CSRF attack could allow an attacker to modify marketing automation workflows, add or remove subscribers, or even delete entire campaigns without the user's knowledge or consent. This could result in significant disruption to marketing efforts, data breaches if sensitive information is exposed, and reputational damage. The attacker needs to craft a malicious request and trick the user into clicking a link or visiting a compromised page while logged into the WordPress site with the Flashyapp plugin installed. The impact is amplified if the plugin is used for critical marketing processes or handles sensitive user data.

1. Reserved2025-10-24
2. Published2025-12-09
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation is to upgrade the WP Flashy Marketing Automation plugin to version 2.0.9 or later. If upgrading is not immediately feasible, consider implementing a Content Security Policy (CSP) to restrict the sources from which the plugin can load resources. Additionally, implement strict user authentication and authorization controls to minimize the potential impact of a successful CSRF attack. Review user roles and permissions to ensure users only have the necessary access. Consider using a WordPress security plugin with CSRF protection features.

Active installs

2KNiche

Plugin rating