CVE-2025-13361

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13361", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T16:36:29.595Z", "datePublished": "2025-12-21T03:20:06.716Z", "dateUpdated": "2026-04-08T17:17:41.914Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:41.914Z"}, "affected": [{"vendor": "dipesh_patel", "product": "Web to SugarCRM Lead", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the custom field deletion functionality. This makes it possible for unauthenticated attackers to delete custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Web to SugarCRM Lead <= 1.0.0 - Cross-Site Request Forgery to Custom Field Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c54b5d-ad73-44f1-afdb-01136ec0b9ae?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/web-to-sugarcrm-lead/trunk/wpscl-admin-functions.php#L496"}, {"url": "https://plugins.trac.wordpress.org/browser/web-to-sugarcrm-lead/tags/1.0.0/wpscl-admin-functions.php#L496"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3423497%40web-to-sugarcrm-lead&new=3423497%40web-to-sugarcrm-lead"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2025-11-26T12:30:08.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-20T14:22:10.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-22T15:43:02.596241Z", "id": "CVE-2025-13361", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-22T15:43:22.341Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13361", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-22T15:43:02.596241Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-22T15:43:15.187Z"}}], "cna": {"title": "Web to SugarCRM Lead <= 1.0.0 - Cross-Site Request Forgery to Custom Field Deletion", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "dipesh_patel", "product": "Web to SugarCRM Lead", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-26T12:30:08.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-20T14:22:10.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c54b5d-ad73-44f1-afdb-01136ec0b9ae?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/web-to-sugarcrm-lead/trunk/wpscl-admin-functions.php#L496"}, {"url": "https://plugins.trac.wordpress.org/browser/web-to-sugarcrm-lead/tags/1.0.0/wpscl-admin-functions.php#L496"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3423497%40web-to-sugarcrm-lead&new=3423497%40web-to-sugarcrm-lead"}], "descriptions": [{"lang": "en", "value": "The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the custom field deletion functionality. This makes it possible for unauthenticated attackers to delete custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:41.914Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13361", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:17:41.914Z", "dateReserved": "2025-11-18T16:36:29.595Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-21T03:20:06.716Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Web to SugarCRM Lead", "vendor": "dipesh_patel", "versions": [{"lessThanOrEqual": "1.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the custom field deletion functionality. This makes it possible for unauthenticated attackers to delete custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Web to SugarCRM Lead para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en todas las versiones hasta la versi\u00f3n 1.0.0 incluida. Esto se debe a la falta de validaci\u00f3n de nonce en la funcionalidad de eliminaci\u00f3n de campos personalizados. Esta vulnerabilidad permite a atacantes no autenticados eliminar campos personalizados mediante una solicitud falsificada, siempre que logren enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n, como hacer clic en un enlace."}], "id": "CVE-2025-13361", "lastModified": "2026-10-19T22:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13361", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-22T15:43:02.596241Z", "version": "2.0.3"}}]}, "published": "2025-12-21T04:16:04.350", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/web-to-sugarcrm-lead/tags/1.0.0/wpscl-admin-functions.php#L496"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/web-to-sugarcrm-lead/trunk/wpscl-admin-functions.php#L496"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3423497%40web-to-sugarcrm-lead&new=3423497%40web-to-sugarcrm-lead"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c54b5d-ad73-44f1-afdb-01136ec0b9ae?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:55:58.088539+00:00", "value": {"mitigation_remediation": ["Update the Web to SugarCRM Lead plugin to a version that implements nonce validation on deletion (if a newer version is available).", "If no update exists, modify or remove the deletion functionality\u2014either by adding a custom nonce check or by disabling the feature entirely to prevent unauthenticated requests from succeeding.", "Deploy a generic WordPress CSRF protection plugin or harden the administration interface so that all state\u2011changing actions require a valid token, and monitor admin pages for unusual or repeated deletion attempts."], "summary": {"action": "Apply Patch", "impact": "Unauthorized deletion of custom fields via Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the dipesh_patel Web to SugarCRM Lead plugin on WordPress installations. All releases up to and including version 1.0.0 are impacted; later releases (if any) have not been indicated as affected.", "description_and_impact": "The Web to SugarCRM Lead plugin for WordPress fails to validate a nonce when deleting custom fields, allowing an attacker to perform a Cross\u2011Site Request Forgery (CSRF). An unauthenticated attacker only needs to trick a site administrator into clicking a forged link. The result is the irreversible removal of custom field definitions, which can disrupt data mapping, lead management, and overall record integrity. This weakness is classified under CWE\u2011352 \u2013 Cross\u2011Site Request Forgery.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate risk, and the EPSS score of less than 1% implies a low probability of exploitation in the near term. The weakness is not listed in CISA\u2019s KEV catalog, further suggesting limited observed exploitation. However, because the attack vector is a simple web\u2011based CSRF, any administrator exposed to a malicious link could trigger the deletion. The impact is limited to data integrity and availability (loss of custom field data), but the attack is possible without authentication."}}}}, "created": "2025-12-23T22:52:26.258660+00:00", "updated": "2026-04-21T17:00:12.326048+00:00", "vendors": ["dipesh_patel", "dipesh_patel$PRODUCT$web_to_sugarcrm_lead", "wordpress", "wordpress$PRODUCT$wordpress"]}