CVE-2025-14077 is a Cross-Site Request Forgery vulnerability in the openchamp Simcast WordPress plugin versions up to 1.0.0. The issue arises from missing or incorrect nonce validation on the settingsPage function, enabling unauthenticated attackers to modify plugin settings if they can deceive an administrator into executing a forged request. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. No patch or remediation information is currently available.

An attacker can cause a site administrator to unknowingly modify plugin settings via a forged request, potentially impacting the integrity of the plugin configuration. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when interacting with untrusted links or sites that could attempt to exploit this vulnerability. Monitoring official openchamp or WordPress plugin advisories for updates is recommended.