CVE-2025-10375 is a CSRF vulnerability in the Web Accessibility by accessiBe WordPress plugin affecting all versions up to 2.10. The issue arises because several AJAX actions (accessibe_signup, accessibe_login, accessibe_license_trial, accessibe_modify_config, and accessibe_add_verification_page) lack nonce validation, which is a security token used to verify the legitimacy of requests. This omission enables attackers to craft forged requests that, when executed by an authenticated administrator (e.g., via clicking a link), can alter plugin configurations or add verification files without proper authorization.

An attacker can leverage this vulnerability to modify plugin settings and create verification files on affected WordPress sites by tricking an administrator into performing a malicious action. While the vulnerability does not directly disclose sensitive data or allow privilege escalation, it can lead to unauthorized configuration changes that may weaken site security or integrity. The CVSS score of 4.3 reflects limited impact primarily on integrity with no confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests related to the plugin and consider disabling or restricting access to the affected AJAX actions if possible. Monitoring vendor channels for updates and applying patches promptly once released is recommended.