Cross-Site Request Forgery Vulnerability in Web to SugarCRM Lead Plugin for WordPress

CVE-2025-13361

What is CVE-2025-13361?

The Web to SugarCRM Lead plugin for WordPress is affected by a Cross-Site Request Forgery vulnerability that allows unauthenticated attackers to delete custom fields. This vulnerability arises from the absence of nonce validation in the custom field deletion feature, enabling attackers to exploit this flaw by tricking an administrator into executing malicious requests through links. All versions of the plugin up to and including 1.0.0 are susceptible to this threat.

References