PT-2025-41666 · WordPress · Web Accessibility By Accessibe

Moose Love · Published 2025-10-11 · Updated 2025-10-11 · CVE-2025-10375

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Web Accessibility By accessiBe plugin for WordPress versions through 2.10

Description The Web Accessibility By accessiBe plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by a lack of nonce validation on several AJAX actions, including accessibe signup, accessibe login, accessibe license trial, accessibe modify config, and accessibe add verification page. An unauthenticated attacker can potentially modify plugin settings and create verification files by deceiving a site administrator into performing an action.

Recommendations Update the Web Accessibility By accessiBe plugin for WordPress to a version later than 2.10.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-10375

Affected Products

Web Accessibility By Accessibe

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-10375 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e3aac40c-1576-45b5-90f8-14ff05c089c7?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3376235%40accessibe&new=3376235%40accessibe&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/accessibe/tags/2.7/class.accessibeforwp.php#L273 · Note
• https://t.me/CVEtracker/34659 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1977065444113535462 · Twitter Post
• https://t.me/cveNotify/138343 · Telegram Post
• https://twitter.com/CVEnew/status/1976948515621552224 · Twitter Post