CVE-2025-13361 is a CSRF vulnerability in the Web to SugarCRM Lead plugin for WordPress (versions up to 1.0.0). The issue arises because the plugin does not implement nonce validation on the custom field deletion functionality, enabling attackers to craft malicious requests that, when executed by an authenticated administrator, result in unauthorized deletion of custom fields. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can be exploited remotely (AV:N).

An attacker can cause an authenticated site administrator to unknowingly delete custom fields in the plugin by tricking them into clicking a malicious link or performing another action that submits a forged request. This impacts the integrity of the plugin's data but does not affect confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should exercise caution with links and actions related to the plugin and consider restricting administrative access or disabling the custom field deletion feature if possible.