CVE-2026-7614 is a CSRF vulnerability in the Old Posts Highlighter WordPress plugin (mkhfr) affecting all versions up to 1.0.3. The issue arises from missing or incorrect nonce validation on the OPH_options function, enabling attackers to update plugin settings without authorization by leveraging an authenticated administrator's interaction with a crafted request. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. No patch or official remediation level has been published, and no known exploits have been observed.

An attacker can cause an authenticated administrator to unknowingly change the plugin's configuration settings via a forged request. This could lead to unauthorized configuration changes but does not directly impact confidentiality or availability. The impact is limited to integrity of the plugin settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing general CSRF protections or using security plugins that enforce nonce validation may help mitigate risk.