CVE-2025-14165 is a Cross-Site Request Forgery vulnerability affecting the Kirim.Email WooCommerce Integration plugin for WordPress in all versions up to and including 1.2.9. The root cause is the absence of nonce validation on the plugin's settings page, which is intended to protect against unauthorized state-changing requests. Exploitation requires tricking an authenticated site administrator into submitting a crafted request, enabling modification of API credentials and integration settings without direct authentication. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). No known exploits in the wild or official patches have been documented in the provided information.

An attacker can modify the plugin's API credentials and integration settings by exploiting this CSRF vulnerability, potentially disrupting email integration functionality or redirecting communications. The impact is limited to integrity as no confidentiality or availability impacts are indicated. Exploitation requires user interaction from an administrator, reducing the likelihood but not eliminating risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into WordPress and consider restricting access to the plugin's settings page to trusted users only. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.