CVE-2025-10700 is a CSRF vulnerability in the Ally – Web Accessibility & Usability WordPress plugin affecting all versions up to 3.8.0. The issue arises from missing or incorrect nonce validation in the enable_unfiltered_files_upload function, enabling unauthenticated attackers to cause an administrator to enable unfiltered file uploads through a crafted request. This could allow SVG files to be added to the upload list if the administrator is tricked into clicking a malicious link. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a medium severity with no direct confidentiality or availability impact but limited integrity impact.

The vulnerability allows attackers to perform unauthorized actions by exploiting the lack of proper nonce validation, specifically enabling unfiltered file uploads including SVG files. This could potentially lead to integrity issues if malicious files are uploaded. However, there is no direct impact on confidentiality or availability. Exploitation requires user interaction by an administrator, and no known exploits are reported in the wild.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should avoid clicking on suspicious links and consider restricting administrative access or implementing additional CSRF protections at the web server or application firewall level to mitigate risk.