CVE-2025-14391 is a Cross-Site Request Forgery vulnerability in the darendev Simple Theme Changer WordPress plugin versions up to 1.0. The issue arises from missing or incorrect nonce validation, which is intended to protect against CSRF attacks. An attacker can exploit this by crafting a malicious request that, if executed by an authenticated site administrator, results in unauthorized changes to the plugin's settings. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a medium severity with low complexity and requiring user interaction.

Successful exploitation allows an attacker to modify the plugin's settings without authentication by leveraging a site administrator's interaction with a malicious link or request. This can lead to unauthorized configuration changes, potentially affecting site behavior or appearance. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.