CVE-2025-10311

Name of the Vulnerable Software and Affected Versions Comment Info Detector versions prior to 1.0.6

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs because the 'options.php' file fails to implement nonce validation—a security mechanism that ensures a request was intentionally sent by the user—when processing form submissions. Consequently, unauthenticated attackers can modify plugin settings by inducing a site administrator to click a malicious link.

Recommendations Update the plugin to version 1.0.6 or later. Restrict access to the 'options.php' file to authorized administrators only.