CVE-2025-14469 describes a CSRF vulnerability in the Theme Editor WordPress plugin by mndpsingh287. The vulnerability exists because the ms_update AJAX action lacks nonce validation, enabling attackers to forge requests that modify child theme CSS styles without authentication. Exploitation requires tricking an administrator into interacting with a crafted request, such as clicking a link. This affects all plugin versions up to and including 3.1.

An attacker can cause unauthorized modification of child theme CSS styles by exploiting the CSRF vulnerability. While the attacker does not gain direct access or confidentiality breaches, the integrity of the website's appearance can be compromised. There is no indication of availability impact or privilege escalation. The vulnerability requires user interaction by an administrator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid interacting with untrusted links or requests that could trigger the ms_update AJAX action. Monitoring for plugin updates from mndpsingh287 is recommended to apply any official fixes once released.