CVE-2025-14464: WordPress PDF Resume Parser Plugin Flaw

CVE-2025-14464 Overview

CVE-2025-14464 is a Sensitive Information Exposure vulnerability affecting the PDF Resume Parser plugin for WordPress. The plugin registers an AJAX action handler that is accessible to unauthenticated users and inadvertently exposes SMTP configuration data, including credentials. This security flaw allows unauthenticated attackers to extract sensitive SMTP credentials (username and password) from the WordPress configuration without requiring any authentication.

Critical Impact

Unauthenticated attackers can remotely extract SMTP credentials from WordPress installations, potentially compromising email accounts and enabling unauthorized access to other systems where the same credentials are reused.

Affected Products

• PDF Resume Parser plugin for WordPress version 1.0 and earlier
• WordPress installations using the vulnerable PDF Resume Parser plugin
• Any system sharing SMTP credentials with the compromised WordPress configuration

Discovery Timeline

• 2026-01-14 - CVE-2025-14464 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2025-14464

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The PDF Resume Parser plugin for WordPress implements an AJAX action handler that fails to properly restrict access to authenticated users only. As a result, the handler responds to requests from any visitor, including unauthenticated users, and returns SMTP configuration details stored within the WordPress installation.

The exposed information includes SMTP server credentials—specifically the username and password—which are critical for email delivery configuration. Attackers who obtain these credentials can leverage them to compromise the associated email accounts, send malicious emails impersonating the legitimate domain, or attempt credential reuse attacks against other systems and services.

Root Cause

The root cause of this vulnerability lies in the improper implementation of WordPress AJAX action handlers. The plugin registers an AJAX endpoint using the wp_ajax_nopriv_ hook prefix (or equivalent mechanism), which makes the handler accessible without requiring user authentication. Additionally, the handler lacks any capability checks or nonce verification that would restrict access to authorized administrators only.

The vulnerable code at line 309 of the plugin source exposes the SMTP configuration without validating the requester's permissions or authentication status.

Attack Vector

The attack can be executed remotely over the network by any unauthenticated user. An attacker simply needs to send an HTTP request to the vulnerable AJAX endpoint on a WordPress site running the affected plugin version. The attack requires no user interaction and has low complexity—the attacker only needs to craft a properly formatted AJAX request to the WordPress installation.

The exploitation process involves sending a crafted POST request to the WordPress AJAX handler (typically /wp-admin/admin-ajax.php) with the appropriate action parameter that triggers the vulnerable function. The server responds with the SMTP configuration data, including plaintext credentials. For detailed technical analysis, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-14464

Indicators of Compromise

• Unusual HTTP POST requests to /wp-admin/admin-ajax.php from unauthenticated sources
• Repeated AJAX requests targeting PDF Resume Parser-specific action handlers
• Suspicious login attempts or authentication failures on email servers using the exposed SMTP credentials
• Unauthorized email activity or spam originating from compromised SMTP accounts

Detection Strategies

• Monitor WordPress access logs for anomalous AJAX requests from unknown or suspicious IP addresses
• Implement Web Application Firewall (WAF) rules to detect and block requests targeting the vulnerable AJAX action
• Review email server authentication logs for signs of credential compromise or unauthorized access attempts
• Deploy SentinelOne Singularity XDR to detect post-exploitation activities stemming from credential theft

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX endpoints to capture request patterns
• Configure alerts for SMTP authentication failures that may indicate attackers testing extracted credentials
• Implement rate limiting on WordPress AJAX handlers to slow down automated credential harvesting attempts
• Monitor outbound email traffic for anomalies that may indicate compromised SMTP accounts

How to Mitigate CVE-2025-14464

Immediate Actions Required

• Immediately deactivate and remove the PDF Resume Parser plugin from all WordPress installations
• Rotate all SMTP credentials that were configured within affected WordPress sites
• Review email server logs for unauthorized access using the potentially compromised credentials
• Scan WordPress installations for indicators of further compromise or persistent access mechanisms

Patch Information

As of the CVE publication date, no patch has been confirmed for the PDF Resume Parser plugin version 1.0. Site administrators should remove the vulnerable plugin and seek alternative solutions for PDF resume parsing functionality. Monitor the WordPress Plugin Repository for updates that address this vulnerability.

Workarounds

• Remove the PDF Resume Parser plugin entirely until a security patch is available
• If the plugin cannot be removed immediately, implement WAF rules to block unauthenticated AJAX requests to the vulnerable action handler
• Restrict access to /wp-admin/admin-ajax.php at the web server level for non-essential functionality
• Use unique SMTP credentials for WordPress that are not shared with other critical systems to limit the blast radius of credential exposure

# Example .htaccess rules to restrict AJAX access (temporary mitigation)
# Add to WordPress root .htaccess file
<Files admin-ajax.php>
    <RequireAll>
        Require all granted
        # Block specific action parameters if identifiable
        # Note: This is a temporary measure, plugin removal is recommended
    </RequireAll>
</Files>