CVE-2025-14904 is a CSRF vulnerability in the Newsletter Email Subscribe WordPress plugin due to incorrect nonce validation on the nels_settings_page function. This flaw enables unauthenticated attackers to update plugin settings by exploiting the trust of an authenticated site administrator who is tricked into executing a forged request. The vulnerability affects versions up to and including 2.4. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and limited impact on integrity only.

An attacker can cause a site administrator to unknowingly change plugin settings by sending a crafted request, potentially leading to unauthorized configuration changes. There is no direct impact on confidentiality or availability reported. The vulnerability requires user interaction (administrator clicking a link) and does not allow remote code execution or data disclosure by itself.

No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress admin. Implementing additional CSRF protections or disabling the plugin if not needed may reduce risk.