CVE-2025-13361: CSRF in Web to SugarCRM Lead WordPress Plugin

攻击者可以利用此CSRF漏洞，通过诱导站点管理员点击恶意链接，伪造请求删除自定义字段。这可能导致数据丢失、配置更改，甚至可能被用于进一步攻击。如果自定义字段包含敏感信息，攻击者可能获取这些信息。由于WordPress插件的广泛使用，该漏洞的潜在影响范围广泛，可能影响大量网站。

Websites utilizing the Web to SugarCRM Lead plugin for WordPress integration, particularly those with shared administrator accounts or those that are frequently targeted by phishing attacks, are at risk. Sites with custom fields critical to their SugarCRM data synchronization are especially vulnerable.

• wordpress / composer / npm:

grep -r 'delete_custom_field' /var/www/wordpress/wp-content/plugins/web-to-sugar-crm-lead/

• wordpress / composer / npm:

wp plugin list --status=active | grep 'web-to-sugar-crm-lead'

• generic web: Check WordPress plugin directory for updates and security advisories related to the Web to SugarCRM Lead plugin. • generic web: Review WordPress access logs for suspicious POST requests targeting custom field deletion endpoints.

1. 2025-12-21Disclosure

   disclosure

1. 已保留2025-11-18
2. 发布日期2025-12-21
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即升级到Web to SugarCRM Lead插件的1.0.1版本。如果无法立即升级，可以考虑实施一些临时缓解措施，例如限制管理员权限，并实施严格的输入验证。此外，可以配置Web应用程序防火墙(WAF)以检测和阻止CSRF攻击。建议定期审查WordPress插件的配置，确保其安全性。