CVE-2025-10300
BaseFortify
Publication date: 2025-10-15
Last updated on: 2025-10-16
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fmeaddons | topbar | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the TopBar WordPress plugin is a Cross-Site Request Forgery (CSRF) issue affecting all versions up to and including 1.0.0. It occurs because the function fme_nb_topbar_save_settings() lacks proper nonce validation, which is a security measure to verify that requests are legitimate. This flaw allows an unauthenticated attacker to trick a site administrator into performing actions such as clicking a malicious link, which then causes the attacker to update the plugin's settings without authorization.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to change the settings of the TopBar plugin on your WordPress site without your consent. Since the attacker can modify plugin settings through a forged request, this could lead to unauthorized changes in the site's appearance or behavior, potentially causing confusion, loss of control over site features, or enabling further attacks depending on what settings are altered.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the TopBar WordPress plugin is installed and running a version up to and including 1.0.0. Since the vulnerability involves missing or incorrect nonce validation in the fme_nb_topbar_save_settings() function, detection could involve monitoring for unauthorized POST requests to the AJAX action that saves settings (typically via admin-ajax.php) without proper nonce tokens. However, no specific detection commands or signatures are provided in the available resources. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or removing the TopBar plugin from your WordPress installation, as it has been closed and removed from download availability pending a security review. Additionally, restrict administrative access and educate site administrators to avoid clicking on suspicious links that could trigger forged requests. Monitoring and applying any future patches or updates from the plugin developer once available is also recommended. [1]