Simcast <= 1.0.0 - Cross-Site Request Forgery to Settings Update

The primary impact of this CSRF vulnerability is the potential for unauthorized modification of the Simcast plugin's settings. An attacker could craft a malicious link or embed a hidden form on a website that, when visited by an administrator, would trigger a forged request to alter the plugin's configuration. This could lead to unexpected behavior, data corruption, or even compromise the integrity of the WordPress site. While the plugin itself may not handle sensitive data directly, changes to its settings could indirectly impact other functionalities or expose the site to further vulnerabilities.

WordPress sites utilizing the Simcast plugin, particularly those with administrators who frequently click on links from untrusted sources, are at risk. Shared hosting environments where multiple WordPress sites share the same server resources could also be affected if one site is compromised.

• wordpress / composer / npm:

grep -r 'settingsPage' /var/www/html/wp-content/plugins/simcast/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/simcast/settings.php | grep -i 'csrf token'

1. 2026-01-07Disclosure

   disclosure

1. Reserviert2025-12-04
2. Veröffentlicht2026-01-07
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The immediate mitigation for CVE-2025-14077 is to disable or remove the Simcast plugin until a patched version is available. If disabling is not an option, implement strict access controls and educate administrators about the risks of clicking on suspicious links or forms. Consider using a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Regularly review plugin settings for any unauthorized changes. Monitor WordPress logs for unusual activity related to the Simcast plugin.