Cross-Site Request Forgery Vulnerability in Simple Theme Changer Plugin for WordPress

CVE-2025-14391

What is CVE-2025-14391?

The Simple Theme Changer plugin for WordPress has a vulnerability that allows unauthenticated attackers to manipulate plugin settings through Cross-Site Request Forgery (CSRF). This issue arises from inadequate nonce validation, which could enable an attacker to trick a site administrator into unknowingly executing a malicious action by clicking a specially crafted link. The vulnerability affects all versions of the plugin up to and including version 1.0, posing a significant risk to the integrity of affected WordPress sites.

References