CVE-2025-10700

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10700", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-18T18:16:45.643Z", "datePublished": "2025-10-16T02:25:10.146Z", "dateUpdated": "2026-04-08T17:34:06.976Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:06.976Z"}, "affected": [{"vendor": "elemntor", "product": "Ally \u2013 Web Accessibility & Usability", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.8.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ally \u2013 Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enable_unfiltered_files_upload function. This makes it possible for unauthenticated attackers to enable unfiltered file upload and add svg files to the upload list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9190d35-c9e7-4190-8e66-f6066fe66af8?source=cve"}, {"url": "https://research.cleantalk.org/cve-2025-10700"}, {"url": "https://plugins.trac.wordpress.org/changeset/3378763/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-09-26T19:07:09.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-15T14:08:58.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-16T14:35:45.423799Z", "id": "CVE-2025-10700", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T14:35:54.173Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10700", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-16T14:35:45.423799Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T14:35:51.461Z"}}], "cna": {"title": "Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "elemntor", "product": "Ally \u2013 Web Accessibility & Usability", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.8.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-26T19:07:09.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-15T14:08:58.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9190d35-c9e7-4190-8e66-f6066fe66af8?source=cve"}, {"url": "https://research.cleantalk.org/cve-2025-10700"}, {"url": "https://plugins.trac.wordpress.org/changeset/3378763/"}], "descriptions": [{"lang": "en", "value": "The Ally \u2013 Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enable_unfiltered_files_upload function. This makes it possible for unauthenticated attackers to enable unfiltered file upload and add svg files to the upload list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-16T02:25:10.146Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10700", "state": "PUBLISHED", "dateUpdated": "2025-10-16T14:35:54.173Z", "dateReserved": "2025-09-18T18:16:45.643Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-16T02:25:10.146Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ally \u2013 Web Accessibility & Usability", "vendor": "elemntor", "versions": [{"lessThanOrEqual": "3.8.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ally \u2013 Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enable_unfiltered_files_upload function. This makes it possible for unauthenticated attackers to enable unfiltered file upload and add svg files to the upload list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Ally - Web Accessibility & Usability para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 3.8.0, inclusive. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la funci\u00f3n enable_unfiltered_files_upload. Esto hace posible que atacantes no autenticados habiliten la carga de archivos sin filtrar y a\u00f1adan archivos SVG a la lista de carga mediante una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-10700", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10700", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-16T14:35:45.423799Z", "version": "2.0.3"}}]}, "published": "2025-10-16T03:15:35.420", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3378763/"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-10700"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9190d35-c9e7-4190-8e66-f6066fe66af8?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:50:35.624145+00:00", "value": {"mitigation_remediation": ["Upgrade the Ally plugin to a version newer than 3.8.0 where nonce validation is correctly implemented.", "If an upgrade is not possible, disable the 'allow unfiltered uploads' option in the WordPress core or in the plugin settings to prevent unrestricted file uploads until a patch is applied.", "Train administrators to avoid clicking suspicious links while logged in and verify any file uploads that appear after an administrator was interacted with."], "summary": {"action": "Update Plugin", "impact": "Unverified file uploads via CSRF exploiting missing nonce validation"}, "threat_synthesis": {"affected_systems": "WordPress sites that run the Ally \u2013 Web Accessibility & Usability plugin version 3.8.0 or earlier. Any site where the plugin is installed and an authenticated administrator is present is vulnerable.", "description_and_impact": "The Ally \u2013 Web Accessibility & Usability plugin contains a flaw where the enable_unfiltered_files_upload function lacks proper nonce validation. An attacker can create a forged request that, when a site administrator clicks a link while logged in, toggles the unfiltered upload setting to true and adds SVG files to the list of allowed file types. With this change, an administrator could unknowingly upload arbitrary files that are not normally permitted.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not yet listed in CISA's KEV catalog. Exploitation would require an attacker to lure an administrator into clicking a crafted URL while logged in, after which the attacker can enable unfiltered uploads and potentially upload malicious files."}}}}, "created": "2025-10-20T13:25:22.625362+00:00", "updated": "2026-04-21T19:00:36.133212+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}