CVE-2025-14391

MediumCVSS 4.3

Published: 12/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

The WordPress plugin Simple Theme Changer in versions up to and including 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation. This allows unauthenticated attackers to update the plugin's settings via a forged request if they can trick an administrator into clicking a link.

Risk Assessment

An attacker could change plugin settings without the administrator's knowledge, potentially leading to unwanted changes in site appearance. This could be used for further attacks.

Recommendation

Update the Simple Theme Changer plugin to a version newer than 1.0 as soon as it becomes available. Until then, restrict admin panel access and educate administrators.

Other vulnerabilities in Simple Theme Changer

CVE-2025-14392Medium
The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings.

Original NVD description (English source)

The Simple Theme Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS