Web Accessibility & Usability Plugin for WordPress Exposed to CSRF Vulnerability
CVE-2025-10700
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 16 October 2025
What is CVE-2025-10700?
The Ally – Web Accessibility & Usability plugin for WordPress is susceptible to a Cross-Site Request Forgery due to inadequate nonce validation in the enable_unfiltered_files_upload function. This vulnerability allows unauthenticated attackers to potentially trick site administrators into enabling unfiltered file uploads. If successful, this could permit the upload of SVG files through a maliciously crafted request, significantly compromising the security of the affected WordPress installation.
Affected Version(s)
Ally – Web Accessibility & Usability * <= 3.8.0