The Web to SugarCRM Lead plugin for WordPress fails to validate a nonce when deleting custom fields, allowing an attacker to perform a Cross‑Site Request Forgery (CSRF). An unauthenticated attacker only needs to trick a site administrator into clicking a forged link. The result is the irreversible removal of custom field definitions, which can disrupt data mapping, lead management, and overall record integrity. This weakness is classified under CWE‑352 – Cross‑Site Request Forgery.

The vulnerability affects the dipesh_patel Web to SugarCRM Lead plugin on WordPress installations. All releases up to and including version 1.0.0 are impacted; later releases (if any) have not been indicated as affected.

The CVSS score of 4.3 indicates a moderate risk, and the EPSS score of less than 1% implies a low probability of exploitation in the near term. The weakness is not listed in CISA’s KEV catalog, further suggesting limited observed exploitation. However, because the attack vector is a simple web‑based CSRF, any administrator exposed to a malicious link could trigger the deletion. The impact is limited to data integrity and availability (loss of custom field data), but the attack is possible without authentication.