CVE-2025-10302 describes a CSRF vulnerability in the Ultimate Viral Quiz WordPress plugin (versions up to 1.0). The issue arises from missing or incorrect nonce validation in the save_options() function, enabling attackers to forge requests that update plugin settings without authentication. Exploitation requires social engineering to convince a site administrator to trigger the malicious request. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), reflecting low impact on confidentiality and availability but limited integrity impact.

An attacker can cause unauthorized changes to the plugin's settings by exploiting the CSRF vulnerability, potentially altering site behavior or configuration. There is no direct impact on confidentiality or availability reported. The attack requires user interaction from an administrator, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links and consider disabling or removing the plugin if possible. Monitoring for updates from the vendor is recommended.