PT-2025-42403 · WordPress · Ally – Web Accessibility & Usability

Dmitry Ignatyev · Published 2025-10-16 · Updated 2025-10-16 · CVE-2025-10700

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ally – Web Accessibility & Usability plugin for WordPress versions prior to 3.8.1

Description The Ally – Web Accessibility & Usability plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by inadequate nonce validation within the enable unfiltered files upload function. Successful exploitation allows unauthenticated attackers to enable unfiltered file uploads and add Scalable Vector Graphics (SVG) files to the upload list by deceiving a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update the Ally – Web Accessibility & Usability plugin to version 3.8.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-10700

Affected Products

Ally – Web Accessibility & Usability

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10700 · Security Note
• https://research.cleantalk.org/cve-2025-10700 · Note
• https://twitter.com/CVEnew/status/1978932556994351254 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3378763 · Note
• https://t.me/cveNotify/138900 · Telegram Post
• https://t.me/CVEtracker/35047 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f9190d35-c9e7-4190-8e66-f6066fe66af8?source=cve · Note