CVE-2025-14795 is a CSRF vulnerability in the Stop Spammers Classic WordPress plugin due to missing nonce validation in the ss_addtoallowlist class. This flaw enables unauthenticated attackers to add email addresses to the spam allowlist by tricking an administrator into executing a forged request. The vulnerability affects all versions up to and including 2026.1, with a partial patch applied in version 2026.1. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with no privileges required but requiring user interaction, and limited integrity impact.

An attacker can cause an administrator to unknowingly add arbitrary email addresses to the spam allowlist, potentially allowing spam emails to bypass filtering. There is no impact on confidentiality or availability. The vulnerability requires user interaction (administrator clicking a crafted link) and does not allow direct code execution or data disclosure.

A partial patch was applied in version 2026.1, but the vulnerability remains. No official full fix or patch link is provided. Users should monitor the vendor advisory for updates and apply any future official patches. Until fully patched, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges.