CVE-2025-14873 is a CSRF vulnerability in the LatePoint WordPress plugin (up to version 5.2.5) caused by the 'call_by_route_name' routing function validating user capabilities without nonce verification. This flaw allows attackers to craft malicious requests that, if an administrator is tricked into clicking, can perform multiple administrative actions without proper authorization checks beyond capability validation. The vulnerability does not affect confidentiality or availability but impacts integrity by enabling unauthorized administrative actions.

The vulnerability allows unauthorized administrative actions to be performed if a site administrator is tricked into executing a malicious request. There is no direct impact on confidentiality or availability reported. The integrity of administrative functions is at risk due to the lack of nonce verification in the routing function.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution to avoid clicking on untrusted links and consider implementing additional CSRF protections or disabling the plugin if feasible.