title: WP Fusion Lite <= 3.37.18 Cross-Site Request Forgery to Data Deletion
description: The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
product: WP Fusion Lite
vendor: Very Good Plugins
versions:
lessThanOrEqual: 3.37.18, status: affected, version: 3.37.18, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
version: 3.1
]
solutions: Update to version 3.37.30 or newer of the plugin.