WP Fusion Lite <= 3.37.18 Cross-Site Request Forgery to Data Deletion

Vulnerability

The WP Fusion Lite plugin for WordPress, up to and including version 3.37.18, is vulnerable to Cross-Site Request Forgery (CSRF) in the show_logs_section function located in ~/includes/admin/logging/class-log-handler.php. This vulnerability allows an attacker to trick an authenticated administrator into performing an unintended action, specifically the deletion of all plugin logs, without their knowledge or consent.[1][2]

Exploitation

To exploit this vulnerability, an attacker must craft a malicious request that triggers the show_logs_section function. The attacker then needs to convince an authenticated administrator with the appropriate capabilities to perform an action, such as clicking a link or visiting a specially crafted webpage, while the administrator has an active session. No additional authentication or user interaction is required beyond that initial click.[1]

Impact

Successful exploitation results in the complete removal of all log data generated by the WP Fusion Lite plugin. While log deletion itself does not directly affect the confidentiality or integrity of user data, it may hinder debugging and auditing activities, potentially allowing further malicious actions to go undetected. This attack does not achieve privilege escalation or code execution.[1]

Mitigation

The vulnerability has been patched in versions after 3.37.18. Users are strongly advised to update to the latest version of WP Fusion Lite, which is 3.47.11.1 as of the publication date of the advisory. No workarounds are available for affected versions. If an immediate update is not possible, consider restricting access to the admin area to trusted users only.[1]