CVE-2025-14354: 
WordPress vulnerability analysis and mitigation

CVE-2025-14354 is a Cross-Site Request Forgery (CSRF) vulnerability in the Resource Library for Logged In Users WordPress plugin, developed by doubledome. It affects all versions up to and including 1.5 (ENISA notes versions up to 1.4 as vulnerable), and stems from missing nonce validation on multiple administrative functions. The vulnerability was published on December 12, 2025, with Wordfence credited as the assigner. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-352 (Cross-Site Request Forgery), arising from the absence of WordPress nonce validation on multiple administrative action handlers within the plugin's core class file (includes/class-ddrll.php, notably at lines 168, 406, and 530). Because these handlers do not verify the origin of incoming requests, an attacker can craft a malicious HTML page or link that, when visited by an authenticated administrator, silently triggers privileged actions such as creating, editing, or deleting resources and categories. Exploitation requires social engineering — the attacker must trick a logged-in site administrator into clicking a forged link or visiting a malicious page (Wordfence, ENISA EUVD).

Successful exploitation allows unauthenticated attackers to manipulate the WordPress site's resource library content — creating, modifying, or deleting resources and categories — by abusing an administrator's authenticated session. The impact is primarily an integrity concern, with no direct confidentiality or availability impact per the CVSS scoring (C:N/I:L/A:N). While the scope is limited to the plugin's content management functions, unauthorized content manipulation could disrupt access to resources for logged-in users and potentially be used to inject malicious links or content into the library (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14354. The EPSS score is extremely low at approximately 0.015%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (an administrator clicking a forged link), which significantly limits its practical attack surface (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites using the "Resource Library for Logged In Users" plugin (version ≤1.5) via passive enumeration (e.g., checking readme.txt or plugin directory listings).
2. Craft forged request: Create an HTML page or email containing a hidden form or <img> tag that submits a request to the target site's WordPress admin AJAX or admin-post endpoint, targeting one of the vulnerable administrative functions (e.g., resource creation, editing, or deletion) in class-ddrll.php.
3. Social engineering: Deliver the malicious link or page to a site administrator via phishing email, forum post, or other channel, enticing them to click it while logged into the WordPress admin panel.
4. Trigger unauthorized action: When the administrator's browser loads the forged request, it is sent with their authenticated session cookies, causing the plugin to execute the administrative action (create/edit/delete resource or category) without nonce verification.
5. Achieve objective: The attacker's desired content manipulation (e.g., injecting a malicious resource link or deleting legitimate content) is completed silently on the target site (Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to admin-ajax.php or admin-post.php endpoints associated with the doubledome-resource-link-library plugin actions, originating from unusual referrers or external domains.
• File System: Unexpected changes to resource library entries in the WordPress database (wp_posts or custom plugin tables), particularly additions, modifications, or deletions not initiated by known administrators.
• Application: Unexplained creation, modification, or deletion of resources/categories in the Resource Library plugin's admin interface without corresponding administrator activity in audit logs.

Users should update the Resource Library for Logged In Users plugin to version 1.5 or later, which introduces proper nonce validation on administrative functions. If an immediate update is not possible, site administrators should avoid clicking links from untrusted sources while logged into the WordPress admin panel, and consider temporarily deactivating the plugin. Restricting access to the WordPress admin area via IP allowlisting provides an additional layer of defense (Wordfence).