CVE-2025-14392 describes a missing authorization vulnerability in the darendev Simple Theme Changer WordPress plugin. The issue arises because the plugin fails to perform capability checks on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions. As a result, authenticated users with subscriber-level privileges or higher can modify plugin settings, which should normally require elevated permissions. This vulnerability affects all versions up to and including 1.0. The CVSS 3.1 base score is 4.3 (medium), reflecting the network attack vector, low attack complexity, and limited impact on integrity without affecting confidentiality or availability.

An attacker with subscriber-level access or higher can modify the plugin's settings without proper authorization. This could lead to unauthorized changes in the website's theme configuration, potentially affecting site appearance or behavior. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals and monitor for unauthorized changes to plugin settings. Avoid granting subscriber-level or higher access to untrusted users.