CVE-2025-14392

MediumCVSS 4.3

Published: 12/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings.

Risk Assessment

An attacker with low privileges can alter the plugin's configuration, potentially leading to unwanted changes in the site's appearance or behavior. This impacts the integrity of the WordPress site settings.

Recommendation

Update the Simple Theme Changer plugin to a version newer than 1.0 as soon as it becomes available, or consider disabling it until a fix is released. Additionally, limit the number of accounts with subscriber-level access and above.

Other vulnerabilities in Simple Theme Changer

CVE-2025-14391Medium
The WordPress plugin Simple Theme Changer in versions up to and including 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation. This allows unauthenticated attackers to update the plugin's settings via a forged request if they can trick an administrator into clicking a link.

Original NVD description (English source)

The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions actions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS