CVE-2025-10377: System Dashboard <= 2.8.20 - Cross-Site Request Forgery
The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. This is due to missing nonce validation on the sdtogglelogs() function. This makes it possible for unauthenticated attackers to toggle critical logging settings including Page Access Logs, Error Logs, and Email Delivery Logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10377?
CVE-2025-10377 has a medium severity due to its potential for Cross-Site Request Forgery.
How do I fix CVE-2025-10377?
To fix CVE-2025-10377, update the System Dashboard plugin to version 2.8.21 or later.
Who is affected by CVE-2025-10377?
All users of the System Dashboard plugin for WordPress up to version 2.8.20 are affected by CVE-2025-10377.
What kind of attack does CVE-2025-10377 enable?
CVE-2025-10377 enables unauthenticated attackers to execute Cross-Site Request Forgery attacks.
What function is vulnerable in CVE-2025-10377?
The sd_toggle_logs() function is vulnerable in CVE-2025-10377 due to missing nonce validation.