CVE-2025-10300
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-15

Last updated on: 2025-10-16

Assigner: Wordfence

Description
The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fme_nb_topbar_save_settings() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-15
Last Modified
2025-10-16
Generated
2026-06-16
AI Q&A
2025-10-15
EPSS Evaluated
2026-06-15
NVD
CVE-2025-10300
EUVD
EUVD-2025-34551
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
fmeaddons topbar *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in the TopBar WordPress plugin is a Cross-Site Request Forgery (CSRF) issue affecting all versions up to and including 1.0.0. It occurs because the function fme_nb_topbar_save_settings() lacks proper nonce validation, which is a security measure to verify that requests are legitimate. This flaw allows an unauthenticated attacker to trick a site administrator into performing actions such as clicking a malicious link, which then causes the attacker to update the plugin's settings without authorization.

Impact Analysis

This vulnerability can impact you by allowing an attacker to change the settings of the TopBar plugin on your WordPress site without your consent. Since the attacker can modify plugin settings through a forged request, this could lead to unauthorized changes in the site's appearance or behavior, potentially causing confusion, loss of control over site features, or enabling further attacks depending on what settings are altered.

Detection Guidance

This vulnerability can be detected by checking if the TopBar WordPress plugin is installed and running a version up to and including 1.0.0. Since the vulnerability involves missing or incorrect nonce validation in the fme_nb_topbar_save_settings() function, detection could involve monitoring for unauthorized POST requests to the AJAX action that saves settings (typically via admin-ajax.php) without proper nonce tokens. However, no specific detection commands or signatures are provided in the available resources. [1, 3]

Mitigation Strategies

Immediate mitigation steps include disabling or removing the TopBar plugin from your WordPress installation, as it has been closed and removed from download availability pending a security review. Additionally, restrict administrative access and educate site administrators to avoid clicking on suspicious links that could trigger forged requests. Monitoring and applying any future patches or updates from the plugin developer once available is also recommended. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-10300. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart