CVE-2025-14464: PDF Resume Parser Information Disclosure

CVE-2025-14464 Overview

CVE-2025-14464 is a Sensitive Information Exposure vulnerability [CWE-200] affecting the PDF Resume Parser plugin for WordPress in all versions up to and including 1.0. The plugin registers an AJAX action handler that is accessible to unauthenticated users and returns SMTP configuration data, including credentials. Unauthenticated attackers can extract the SMTP username and password from the WordPress configuration. Recovered credentials can be used to compromise the associated email account and may unlock other systems where the same credentials are reused.

Critical Impact
Unauthenticated remote attackers can retrieve SMTP credentials over the network, enabling email account takeover and credential reuse attacks against connected services.

Affected Products

WordPress PDF Resume Parser plugin versions up to and including 1.0
WordPress sites with the PDF Resume Parser plugin active
Environments where the plugin's SMTP credentials are reused on other services

Discovery Timeline

2026-01-14 - CVE-2025-14464 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14464

Vulnerability Analysis

The PDF Resume Parser plugin registers an AJAX action that returns SMTP configuration values to any caller. WordPress exposes AJAX endpoints through wp-admin/admin-ajax.php, and plugins must hook actions under wp_ajax_{action} for authenticated users and wp_ajax_nopriv_{action} for unauthenticated users. Registering the handler under the nopriv variant makes the response reachable without a valid session.

The handler reads SMTP settings, which include the host, username, and password, and serializes them into the response. No capability check, nonce verification, or output filtering removes the credential fields before transmission. An attacker only needs the public site URL and the action name to retrieve the data.

Recovered SMTP credentials let attackers send mail as the site, read inbox contents on the upstream provider, and attempt the same username and password against other services. The flaw is referenced in the plugin source at line 309 of pdf-resume-parser.php.

Root Cause

The root cause is missing authorization on a sensitive AJAX endpoint combined with returning secret material in the response body. The plugin treats stored SMTP settings as non-sensitive output rather than as credentials requiring access control.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker sends an HTTP request to admin-ajax.php specifying the vulnerable action name. The server returns SMTP host, username, and password values in the JSON response. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for technical details.

Detection Methods for CVE-2025-14464

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php referencing the PDF Resume Parser action handler
HTTP responses from admin-ajax.php containing smtp, username, or password JSON keys
Outbound SMTP authentication attempts from unfamiliar IP addresses using the site's mailer account
Unexpected sent-mail entries in the upstream SMTP provider's logs

Detection Strategies

Inspect web server access logs for repeated requests to admin-ajax.php containing the plugin's action parameter from unauthenticated clients
Alert on response bodies from admin-ajax.php whose size or content signature indicates credential disclosure
Correlate failed and successful logins on the SMTP provider with the source IP addresses of recent admin-ajax.php requests

Monitoring Recommendations

Enable WordPress audit logging for AJAX actions registered by third-party plugins
Forward SMTP provider authentication logs to the SIEM and alert on logins from new geolocations or autonomous system numbers
Track installed WordPress plugins and flag any version of PDF Resume Parser at or below 1.0

How to Mitigate CVE-2025-14464

Immediate Actions Required

Deactivate and remove the PDF Resume Parser plugin until a patched version is published
Rotate the SMTP account password and any reused credentials on other services
Review SMTP provider sent-mail and authentication logs for unauthorized activity since the plugin was installed
Block requests to the vulnerable AJAX action at the web application firewall layer

Patch Information

No fixed version is listed in the published advisory at the time of writing. All versions up to and including 1.0 are affected. Monitor the Wordfence Vulnerability Report and the plugin repository for a patched release.

Workarounds

Remove the plugin entirely if a patch is not yet available
Restrict access to admin-ajax.php for the vulnerable action via web server rules or a WAF
Store SMTP credentials in environment variables or a secrets manager rather than plugin options where feasible
Use a dedicated SMTP account per site with least-privilege scopes to limit blast radius

bash

# Example nginx rule blocking the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "pdf_resume_parser") {
        return 403;
    }
}