CVE-2025-14465 identifies a CSRF vulnerability in the Sticky Action Buttons WordPress plugin by praveentamil. The issue arises from improper or absent nonce validation in the sabs_options_page_form_submit() function, enabling attackers to perform unauthorized changes to plugin settings via forged requests. Exploitation requires social engineering to induce an administrator to interact with a crafted link. The vulnerability affects all versions up to and including 1.1. There is no vendor advisory or patch information available at this time.

An attacker can cause an administrator to unknowingly submit a request that changes the plugin's settings, potentially leading to unauthorized configuration changes. The vulnerability does not allow direct compromise of confidentiality or availability but impacts integrity of plugin settings. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security channels is recommended.