Cross-Site Request Forgery in Comment Info Detector Plugin for WordPress

CVE-2025-10311

What is CVE-2025-10311?

The Comment Info Detector plugin for WordPress contains a vulnerability that allows unauthenticated attackers to execute a Cross-Site Request Forgery (CSRF) attack. This issue arises due to insufficient nonce validation on the options.php file, thereby enabling an attacker to manipulate plugin settings if they successfully trick a site administrator into submitting a maliciously crafted request, such as clicking on a deceptive link.

References