CVE-2025-0810 is a CSRF vulnerability in the edmonparker Read More & Accordion WordPress plugin affecting all versions up to 3.4.7. The issue arises from improper or missing nonce validation on the addNewButtons() function, enabling attackers to craft forged requests that, if executed by an administrator, can lead to arbitrary PHP file inclusion and execution. This vulnerability requires user interaction (UI:R) and has a network attack vector (AV:N) with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).

Successful exploitation could allow an attacker to execute arbitrary PHP code on the affected WordPress site, potentially leading to full site compromise including data theft, site defacement, or denial of service. The attack requires tricking an administrator into performing an action, making it a targeted social engineering risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests that could trigger the vulnerable function. Implementing additional security controls such as Web Application Firewalls (WAF) with CSRF protections may help mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.