Security Alert Summary
The PDF Resume Parser plugin for WordPress (all versions up to and including 1.0) contains an information exposure vulnerability. The plugin registers an AJAX action handler that is accessible to unauthenticated users and can disclose SMTP configuration data, including credentials. An unauthenticated actor able to trigger that handler may be able to extract SMTP usernames and passwords from site configuration.
CVE Details
- CVE ID:
CVE-2025-14464 - Affected component: PDF Resume Parser plugin for WordPress
- Affected versions: All versions up to, and including, 1.0
- Published: January 14, 2026 at 6:15 AM UTC
- Last modified: January 14, 2026 at 4:25 PM UTC
- CVSS v3.1: Base Score 5.3, Severity MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE (unauthenticated access)
- User Interaction: NONE
- Scope: UNCHANGED
- Impact: Confidentiality IMPACT = LOW; Integrity = NONE; Availability = NONE
- Authentication / Privileges: Unauthenticated access is sufficient to trigger the vulnerable handler (PR:N)
- CWE / Weakness: CWE-200 (Information Exposure)
Technical Details
According to the CVE description, the plugin registers an AJAX action handler that is reachable by unauthenticated users. That handler exposes SMTP configuration data stored in the WordPress configuration, including credential values such as username and password. Because the AJAX action is callable without authentication and returns SMTP configuration, an attacker who can make the appropriate AJAX request may retrieve those credentials.
The core issue is an information exposure via an unauthenticated AJAX endpoint: required access checks are missing or not enforced for the action handler, allowing sensitive site configuration to be returned to any requester. The immediate technical impact is disclosure of SMTP credentials; the disclosure of those credentials could be used to send email from the site’s mail server or to attempt access to other systems that reuse the same credentials.
How This Could Impact Your Website
Consider a site with a site owner, an internal staff member who manages content, and an external contractor who uploads resumes or content. An unauthenticated attacker who discovers and calls the exposed AJAX action could retrieve SMTP credentials. With those credentials an attacker could send emails that appear to come from the organization, increasing the risk of successful phishing or social engineering attacks against staff and external contacts. If the exposed credentials are reused elsewhere, there is additional risk of unauthorized access to other accounts or systems.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (No fixed version is specified in the CVE entry.)
- Until a patch is applied, consider disabling the plugin or blocking access to any AJAX endpoints introduced by it where practical.
- Review and reduce unnecessary user roles and capabilities, especially for contributors or untrusted accounts.
- Enforce strong, unique passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site and mail-server activity for unusual behavior, such as unexpected outbound email volume or login attempts using exposed credentials.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
