CVE-2025-10300 is a CSRF vulnerability in the fmeaddons TopBar WordPress plugin affecting all versions up to 1.0.0. The vulnerability arises from missing or incorrect nonce validation in the fme_nb_topbar_save_settings() function, enabling attackers to forge requests that update plugin settings by exploiting administrator user interaction. The vulnerability is network exploitable without privileges but requires user interaction. The CVSS 3.1 base score is 4.3 (medium severity), reflecting limited impact on integrity with no confidentiality or availability impact. No known exploits in the wild or vendor patches are currently documented.

An attacker can cause a site administrator to unknowingly submit a forged request that modifies the TopBar plugin settings. This could lead to unauthorized changes in the plugin configuration, potentially affecting site behavior or appearance. There is no direct impact on confidentiality or availability reported. The vulnerability requires user interaction and no privileges, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and actions performed by privileged users. Monitoring for updates from the vendor fmeaddons or WordPress plugin repository is recommended to apply any forthcoming patches promptly.