The System Dashboard plugin for WordPress (qriouslad) contains a CSRF vulnerability (CVE-2025-10377) due to missing nonce validation in the sd_toggle_logs() function. This flaw allows unauthenticated attackers to send forged requests that, if a site administrator interacts with them, can toggle important logging settings including Page Access Logs, Error Logs, and Email Delivery Logs. The vulnerability affects all versions up to and including 2.8.20 and has a CVSS 3.1 base score of 4.3 (medium severity). No patch or official fix information is currently available, and no known exploits have been reported.

An attacker can cause an administrator to unknowingly change logging configurations, potentially disabling or enabling logs that track page access, errors, and email delivery. This may hinder incident detection or forensic analysis but does not directly compromise confidentiality or availability. The integrity of logging settings is impacted, which could affect security monitoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about interacting with untrusted links or requests while logged into the WordPress admin interface. Implementing additional CSRF protections or nonce validation in the plugin code is recommended once a patch is released.