CVE-2025-13361: 
WordPress vulnerability analysis and mitigation

CVE-2025-13361 is a Cross-Site Request Forgery (CSRF) vulnerability in the Web to SugarCRM Lead plugin for WordPress. It affects all versions up to and including 1.0.0, and stems from missing nonce validation on the custom field deletion functionality. An unauthenticated attacker can delete custom fields by tricking a site administrator into clicking a malicious link. It carries a CVSS v3.1 base score of 4.3 (Medium) and was published on December 21, 2025 (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and exists because the plugin's custom field deletion handler in wpscl-admin-functions.php (around line 496) does not validate a WordPress nonce before processing deletion requests (Wordfence, WordPress Trac). Because WordPress nonces are the standard mechanism for verifying that a request was intentionally submitted by an authenticated user, their absence allows any forged HTTP request to trigger the deletion action. Exploitation requires social engineering — the attacker must lure a logged-in administrator to visit a crafted page or click a malicious link that silently submits the forged request.

Successful exploitation allows an unauthenticated attacker to delete custom fields configured within the Web to SugarCRM Lead plugin, resulting in a loss of data integrity for the CRM lead capture configuration. There is no confidentiality or availability impact (no data is exposed and the WordPress site itself remains operational), but the deletion of custom fields could disrupt lead generation workflows and require manual reconfiguration (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13361. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for administrator interaction, limiting its practical impact.

1. Reconnaissance: Identify WordPress sites running the Web to SugarCRM Lead plugin (version ≤ 1.0.0) via passive enumeration (e.g., checking plugin directories or HTTP response headers).
2. Craft forged request: Construct an HTML page or link containing a hidden form or <img> tag that submits a POST/GET request to the target WordPress admin endpoint responsible for custom field deletion (handled in wpscl-admin-functions.php).
3. Social engineering: Deliver the malicious link or page to a site administrator via phishing email, forum post, or other channel, inducing them to click it while authenticated to their WordPress dashboard.
4. Trigger deletion: When the administrator's browser loads the attacker-controlled page, it automatically sends the forged request to the WordPress site. Because no nonce is validated, the server processes the request and deletes the targeted custom field(s) (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unexpected POST or GET requests to the admin-ajax endpoint or plugin-specific admin pages for custom field deletion, originating from unusual referrers or external domains.
• Application: Unexplained disappearance of custom fields in the Web to SugarCRM Lead plugin settings, particularly if no administrator intentionally performed a deletion.
• Network: Requests to WordPress admin endpoints from IP addresses not associated with known administrators, especially if the referrer header points to an external or unknown domain.

The plugin vendor (dipesh_patel) released a patch in changeset 3423497, which can be reviewed on the WordPress plugin repository. Site administrators should update the Web to SugarCRM Lead plugin to the patched version immediately. As a temporary workaround, administrators can deactivate the plugin until an update is applied, or restrict access to WordPress admin pages using IP allowlisting (Wordfence).