CVE-2025-14907 identifies a CSRF vulnerability in the Moderate Selected Posts WordPress plugin (versions up to 1.4). The issue arises from the absence of nonce verification in the msp_admin_page() function, which is intended to protect against unauthorized requests. Because of this, attackers can craft forged requests that, when executed by an authenticated administrator, result in unauthorized modification of plugin settings. The vulnerability does not require privileges or authentication but does require user interaction (UI:R). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and limited impact on integrity only.

An attacker can cause an administrator to unknowingly modify plugin settings by tricking them into clicking a malicious link or performing a similar action. This could lead to unauthorized changes in the plugin configuration, potentially affecting site behavior or security posture. There is no direct impact on confidentiality or availability reported. No known exploits in the wild have been documented.

No official patch or fix is currently available for this vulnerability. Administrators should exercise caution and avoid interacting with untrusted links or requests that could trigger plugin settings changes. Monitor the vendor's advisory channels for updates regarding patches or official remediation. Since this is a CSRF issue, implementing nonce verification in the plugin code is the appropriate fix once available.