CVE-2025-10375: accessiBe WordPress Plugin CSRF Vulnerability

CVE-2025-10375 Overview

The Web Accessibility By accessiBe plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 2.10. The flaw stems from missing nonce validation on multiple AJAX actions, including accessibe_signup, accessibe_login, accessibe_license_trial, accessibe_modify_config, and accessibe_add_verification_page. Unauthenticated attackers can modify plugin settings and create verification files by tricking a site administrator into clicking a crafted link. The vulnerability is classified under CWE-352.

Critical Impact
Successful exploitation allows attackers to alter plugin configuration and create attacker-controlled verification files on the WordPress site, requiring only that an administrator interact with a malicious link.

Affected Products

Web Accessibility By accessiBe plugin for WordPress — all versions ≤ 2.10
WordPress sites with the plugin active and administrator sessions in use
Any deployment where the plugin's AJAX endpoints are reachable

Discovery Timeline

2025-10-11 - CVE-2025-10375 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10375

Vulnerability Analysis

The plugin registers several AJAX handlers that perform state-changing operations without verifying a WordPress nonce. Without nonce validation, WordPress cannot confirm that a request originated from a legitimate administrator-initiated form or link within the admin interface. An attacker hosting a crafted page can submit requests to the vulnerable endpoints on behalf of an authenticated administrator who visits the attacker's page.

The affected AJAX actions cover account signup, login handling, license trial activation, configuration modification, and verification page creation. Each action processes attacker-influenced parameters when the browser of an authenticated administrator issues the forged request. The result is unauthorized configuration changes and the ability to plant arbitrary verification files.

The vulnerability requires user interaction, and the impact is limited to integrity of plugin state and site-owned resources. Confidentiality and availability are not directly affected according to the published CVSS vector.

Root Cause

The root cause is the absence of check_ajax_referer() or equivalent nonce verification within the AJAX callback functions registered by the plugin. WordPress provides nonces specifically to prevent CSRF on privileged endpoints, and this control was not applied to the affected handlers. Reference implementation details are visible in the WordPress Accessibe Class Code.

Attack Vector

An attacker crafts an HTML page or link containing a form or fetch request targeting admin-ajax.php with one of the vulnerable action values. The attacker delivers the link to a WordPress administrator through phishing, a compromised third-party site, or forum content. When the administrator visits the page while authenticated to WordPress, the browser automatically sends session cookies with the forged request, and the plugin processes it as legitimate.

See the Wordfence Vulnerability Analysis for additional technical context. No public exploit code has been observed at time of writing.

Detection Methods for CVE-2025-10375

Indicators of Compromise

Unexpected POST requests to wp-admin/admin-ajax.php with action values accessibe_signup, accessibe_login, accessibe_license_trial, accessibe_modify_config, or accessibe_add_verification_page whose HTTP Referer header points to an external domain.
New or modified verification files in the WordPress web root that were not created by an administrator.
Unexplained changes to accessiBe plugin configuration or license state in the WordPress admin dashboard.

Detection Strategies

Review web server access logs for requests to admin-ajax.php carrying the affected action parameters and cross-reference the Referer header against approved admin origins.
Enable WordPress audit logging to capture option and file changes tied to the plugin, and alert on modifications outside change-management windows.
Correlate administrator browser activity with plugin state changes to identify requests generated by external pages rather than the WordPress admin UI.

Monitoring Recommendations

Alert on file creation events under the WordPress document root that match verification file naming patterns emitted by the plugin.
Track outbound clicks and email links reaching administrators, and inspect landing pages that reference admin-ajax.php.
Monitor plugin version inventory across managed WordPress sites to confirm all instances are upgraded beyond version 2.10.

How to Mitigate CVE-2025-10375

Immediate Actions Required

Update the Web Accessibility By accessiBe plugin to a version later than 2.10 once released by the vendor. Confirm the fix by reviewing the plugin's WordPress Accessibe Changeset history.
Audit existing plugin configuration and remove any verification files that cannot be attributed to a legitimate administrator action.
Require administrators to log out of WordPress sessions before browsing untrusted content, and enforce short session lifetimes.

Patch Information

The vendor has committed changes visible in the plugin's Subversion repository. Site owners should install the latest available version from the WordPress plugin directory and verify that nonce checks are present on all AJAX handlers. Consult the Wordfence Vulnerability Analysis for the fixed version reference.

Workarounds

Deactivate the accessiBe plugin until a patched release is installed if immediate updating is not possible.
Restrict access to wp-admin/admin-ajax.php using a web application firewall rule that blocks requests carrying the affected action parameters with off-site Referer or Origin headers.
Require administrators to use a dedicated browser profile for WordPress administration to reduce the chance of cross-site request forgery via other tabs.

bash

# Example WAF rule fragment to block off-origin AJAX to affected actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1010375,msg:'Block accessiBe CSRF attempts'"
  SecRule ARGS:action "@rx ^(accessibe_signup|accessibe_login|accessibe_license_trial|accessibe_modify_config|accessibe_add_verification_page)$" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/"