CVE-2025-14462 is a CSRF vulnerability in the Lucky Draw Contests WordPress plugin by owais4377 affecting all versions up to 4.2. The issue arises from missing or incorrect nonce validation in the misc-settings.php file, enabling attackers to forge requests that update plugin settings without proper authorization. Exploitation requires social engineering to induce an administrator to perform an action such as clicking a crafted link. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3 (Network attack vector, low attack complexity, no privileges required, requires user interaction, impacts integrity only).

An attacker can modify plugin settings without authentication by exploiting the CSRF vulnerability if an administrator is tricked into clicking a malicious link. This could lead to unauthorized changes in the plugin configuration, potentially affecting site behavior or security. There is no indication of direct confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and consider restricting administrative access or implementing additional CSRF protections at the site level.