WordPress WP Flashy Marketing Automation plugin <= 2.0.8 - Vulnérabilité Cross Site Request Forgery (CSRF)

A successful CSRF attack could allow an attacker to modify marketing automation workflows, add or remove subscribers, or even delete entire campaigns without the user's knowledge or consent. This could result in significant disruption to marketing efforts, data breaches if sensitive information is exposed, and reputational damage. The attacker needs to craft a malicious request and trick the user into clicking a link or visiting a compromised page while logged into the WordPress site with the Flashyapp plugin installed. The impact is amplified if the plugin is used for critical marketing processes or handles sensitive user data.

Websites using the WP Flashy Marketing Automation plugin, particularly those with automated marketing campaigns or handling sensitive subscriber data, are at risk. Shared hosting environments where plugin updates are managed by the hosting provider may be particularly vulnerable if they haven't applied the update.

• wordpress / composer / npm:

grep -r 'flashyapp/wp-flashy-marketing-automation' /var/www/html/
wp plugin list | grep 'Flashyapp WP Flashy Marketing Automation'

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/wp-flashy-marketing-automation/ | grep -i 'flashyapp'

1. 2025-12-09Disclosure

   disclosure

1. Réservé2025-10-24
2. Publiée2025-12-09
3. Modifiée2026-04-28
4. EPSS mis à jour2026-03-23

The primary mitigation is to upgrade the WP Flashy Marketing Automation plugin to version 2.0.9 or later. If upgrading is not immediately feasible, consider implementing a Content Security Policy (CSP) to restrict the sources from which the plugin can load resources. Additionally, implement strict user authentication and authorization controls to minimize the potential impact of a successful CSRF attack. Review user roles and permissions to ensure users only have the necessary access. Consider using a WordPress security plugin with CSRF protection features.

Installations actives

2KNiche

Note du plugin