CVE-2025-14167 is a CSRF vulnerability in the Remove Post Type Slug WordPress plugin (up to version 1.0.2) caused by incorrect nonce validation logic. The plugin uses an OR condition rather than an AND condition to check nonce validity, which results in validation passing incorrectly when it should fail. This allows an attacker to craft a forged request that, if executed by an authenticated administrator, can alter the plugin's post type slug removal settings without proper authorization.

An attacker can modify plugin settings without authentication by exploiting the CSRF vulnerability, potentially altering site behavior related to post type slugs. The vulnerability does not allow direct data disclosure or denial of service but can lead to unauthorized configuration changes. The CVSS score of 4.3 reflects a medium impact primarily on integrity with no impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider disabling or replacing the plugin to prevent exploitation. Implementing additional CSRF protections at the site level may help mitigate risk.