Analysis Report Folder Analysis cache/web-to-sugarcrm-lead_1.0.0 → cache/web-to-sugarcrm-lead_1.0.1 - CVE-2025-13361

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Request Forgery (CSRF) - CWE-352 - wpscl-admin-functions.php Lines 499-515

Old Code:
```php
if (isset($_POST['pid'])) {
    $pid = absint($_POST['pid']);
    $where = array('pid' => $pid);
    $delete = $wpdb->delete(WPSCL_TBL_MAP_FIELDS, $where);
    if ($delete !==false) {
        echo esc_html__('Field deleted successfully', 'WPSCL');
    } else {
        echo esc_html__('Error occured ! Please try again', 'WPSCL');
    }
}
```

Fixed Code:
```php
check_ajax_referer('WPSCL', 'wpscl_nonce');

if (!isset($_POST['pid'])) {
    wp_die(esc_html__('Invalid request.', 'WPSCL'), 'Error', array('back_link' => true));
}

$pid = absint($_POST['pid']);
$where = array('pid' => $pid);
$delete = $wpdb->delete(WPSCL_TBL_MAP_FIELDS, $where);
if ($delete !==false) {
    echo esc_html__('Field deleted successfully', 'WPSCL');
} else {
    echo esc_html__('Error occured ! Please try again', 'WPSCL');
}
```

Explanation:
The old code was vulnerable to CSRF attacks because it performed a destructive database operation (field deletion) without validating a nonce token. An attacker could craft a malicious request that, when visited by an authenticated admin, would delete arbitrary custom fields without the admin's explicit consent. The fix adds `check_ajax_referer('WPSCL', 'wpscl_nonce')` at the beginning of the function to verify a valid WordPress nonce token was provided with the request, preventing CSRF attacks. Additionally, the improved input validation with explicit error handling (wp_die) makes the request validation more robust.

```
Vulnerability Existed: no
No Security Vulnerabilities Detected - [N/A] - wpscl.php [1-10]

Old Code:
Version: 1.0.0

Fixed Code:
Version: 1.0.1

Explanation:
This diff only contains a version number bump from 1.0.0 to 1.0.1 in the plugin header comment. There are no code changes, logic modifications, input validation improvements, or security-related fixes. This is a metadata-only change and does not address, introduce, or modify any security-related functionality. No vulnerabilities are present in this change.
```