CVE-2025-10311 is a CSRF vulnerability in the Comment Info Detector plugin for WordPress by tom_riddle. The issue arises because the plugin fails to validate nonces on form submissions processed by options.php, enabling attackers to forge requests that change plugin settings without authentication. Exploitation requires social engineering to convince an administrator to perform an action such as clicking a crafted link. The vulnerability affects all versions up to and including 1.0.5.

An attacker can modify plugin settings without authentication by exploiting the CSRF vulnerability, potentially altering the plugin's behavior or configuration. There is no direct confidentiality or availability impact reported. The attack requires user interaction from an administrator, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links and consider disabling or removing the vulnerable plugin. Monitoring for updates from the vendor or plugin author is recommended.