Technical impact
The System Dashboard WordPress plugin exposes a function to toggle logging settings without validating a nonce. This lack of protection allows an attacker to send a forged request that, when an administrator follows a malicious link, changes the state of critical logs including Page Access Logs, Error Logs, and Email Delivery Logs. By disabling or altering these logs, an attacker can erase evidence of other malicious activity, undermining forensic investigations and monitoring capabilities. The weakness is a classic Cross‑Site Request Forgery, identified as CWE‑352, and it permits unauthorized configuration changes but does not provide code execution or direct data exfiltration.
Affected Systems
The vulnerability affects the System Dashboard plugin developed by qriouslad. All releases up to and including version 2.8.20 are impacted. Specifically, any WordPress installation running System Dashboard 2.8.20 or earlier is at risk when an administrator has the option to access the admin logging toggle interface.
Risk and Exploitability
The CVSS score of 4.3 reflects a moderate risk level, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited active exploitation. An attacker would need to entice a site administrator to click a crafted link or form, relying on social engineering to trigger a CSRF request. Because the attack requires the victim to be authenticated, the threat surface is confined to trusted admin accounts; however, the damage potential lies in disabling crucial logging that supports incident response.
EUVD