accessiBe CVE-2025-10375

Requires that the WordPress site run the Web Accessibility By accessiBe plugin version 2.10 or earlier, and that an authenticated administrator be tricked into clicking an attacker-supplied link or visiting a malicious page while their WordPress session is active (UI:R). The affected AJAX actions - accessibe_signup, accessibe_login, accessibe_license_trial, accessibe_modify_config, and accessibe_add_verification_page - lack nonce validation, so no attacker authentication is needed, but the mandatory admin interaction and the integrity-only impact (settings modification and verification-file creation, no data exposure or RCE) sharply limit realistic exploitation.

This is a genuinely low-priority issue despite being remotely reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N = 4.3 Medium) describes a classic CSRF: although PR:N marks it 'unauthenticated,' exploitation is gated on UI:R - an authenticated administrator must be socially engineered into clicking an attacker-controlled link while logged in. The impact is capped at I:L (low integrity, no confidentiality or availability loss), consistent with tampering with plugin settings and dropping verification files rather than code execution. All signals converge toward low real-world risk: EPSS is 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit code was identified. No signals conflict - the low EPSS, absent KEV, and modest technical impact all agree. The only nuance is the PR:N/UI:R combination, which can read as 'unauthenticated' at a glance but in practice requires an admin victim and a successful phishing step, so it is far less automatable than a true no-interaction remote flaw.

An attacker crafts a malicious web page or email link containing a hidden auto-submitting form targeting one of the unprotected AJAX endpoints (e.g. accessibe_modify_config or accessibe_add_verification_page). While logged into WordPress, a site administrator visits the page or clicks the link, and their browser silently submits the forged request, altering accessiBe plugin configuration or planting a verification file. No public exploit code was identified at time of analysis, and success depends entirely on tricking an authenticated admin.