CVE-2025-14160 is a CSRF vulnerability in the Upcoming for Calendly WordPress plugin (up to version 1.2.4). The issue arises from the absence of nonce validation on the plugin's settings update endpoint, which enables attackers to forge requests that update the Calendly API key without proper authorization. Exploitation requires social engineering to convince an administrator to perform an action like clicking a crafted link. The vulnerability is network exploitable with low attack complexity and requires user interaction.

An attacker can cause an administrator to unknowingly update the plugin's Calendly API key via a forged request. This could lead to unauthorized changes in plugin configuration, potentially impacting the integration with Calendly services. There is no direct confidentiality or availability impact reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links and consider restricting administrative access or using additional security plugins that enforce nonce validation or CSRF protections.