CVE-2021-34661 — WP Fusion Lite <= 3.37.18 Cross-Site Request Forgery to Data Deletion

Description (CNA)

The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18.

Affected (CNA)

Vendor / product	Versions
Very Good Plugins / WP Fusion Lite	affected 3.37.18 through 3.37.18

CWE

CWE-352

References

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34661
https://plugins.trac.wordpress.org/browser/wp-fusion-lite/trunk/includes/admin/logging/class-log-handler.php?rev=2533608#L302

ADP enrichment

CVE

No English description supplied.

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34661
https://plugins.trac.wordpress.org/browser/wp-fusion-lite/trunk/includes/admin/logging/class-log-handler.php?rev=2533608#L302

CISA-ADP

No English description supplied.

No references supplied.