Analysis Report · Folder Analysis cache/web-to-sugarcrm-lead_1.0.0 → cache/web-to-sugarcrm-lead_1.0.1 — CVE-2025-13361

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Request Forgery (CSRF) - CWE-352 - wpscl-admin-functions.php Lines 499-515

Old Code:
```php
if (isset($_POST['pid'])) {
    $pid = absint($_POST['pid']);
    $where = array('pid' => $pid);
    $delete = $wpdb->delete(WPSCL_TBL_MAP_FIELDS, $where);
    if ($delete !==false) {
        echo esc_html__('Field deleted successfully', 'WPSCL');
    } else {
        echo esc_html__('Error occured ! Please try again', 'WPSCL');
    }
}
```

Fixed Code:
```php
check_ajax_referer('WPSCL', 'wpscl_nonce');

if (!isset($_POST['pid'])) {
    wp_die(esc_html__('Invalid request.', 'WPSCL'), 'Error', array('back_link' => true));
}

$pid = absint($_POST['pid']);
$where = array('pid' => $pid);
$delete = $wpdb->delete(WPSCL_TBL_MAP_FIELDS, $where);
if ($delete !==false) {
    echo esc_html__('Field deleted successfully', 'WPSCL');
} else {
    echo esc_html__('Error occured ! Please try again', 'WPSCL');
}
```

Explanation:
The old code was vulnerable to CSRF attacks because it performed a destructive database operation (field deletion) without validating a nonce token. An attacker could craft a malicious request that, when visited by an authenticated admin, would delete arbitrary custom fields without the admin's explicit consent. The fix adds `check_ajax_referer('WPSCL', 'wpscl_nonce')` at the beginning of the function to verify a valid WordPress nonce token was provided with the request, preventing CSRF attacks. Additionally, the improved input validation with explicit error handling (wp_die) makes the request validation more robust.