CVE-2025-14161 is a CSRF vulnerability in the Truefy Embed WordPress plugin affecting all versions up to 1.1.0. The issue is caused by the lack of nonce validation on the settings update action 'truefy_embed_options_update'. This allows attackers to forge requests that update plugin settings, including sensitive data like API keys, if an administrator is tricked into executing the request. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

An attacker can update the plugin's settings without authentication by exploiting the CSRF vulnerability, potentially modifying critical configuration such as the API key. This could lead to unauthorized changes in the plugin behavior or integration, but does not directly impact confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links while logged into WordPress and consider restricting access to the plugin settings page. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.