CVE-2025-10375
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.10. Missing nonce validation on multiple AJAX actions allows unauthenticated attackers to modify plugin settings and create verification files via forged requests.
Risk Assessment
An attacker can trick an administrator into clicking a link, allowing modification of plugin settings or creation of verification files, potentially leading to site compromise.
Recommendation
Update the accessiBe plugin to the latest version that includes CSRF fixes. Additionally, educate administrators about the risks of clicking suspicious links.
Other vulnerabilities in Web Accessibility By accessiBe
Original NVD description (English source)
The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10. This is due to missing nonce validation on multiple AJAX actions including accessibe_signup, accessibe_login, accessibe_license_trial, accessibe_modify_config, and accessibe_add_verification_page. This makes it possible for unauthenticated attackers to modify plugin settings and create verification files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS