CVE-2025-14464: 
WordPress vulnerability analysis and mitigation

CVE-2025-14464 is a Sensitive Information Exposure vulnerability in the PDF Resume Parser plugin for WordPress, affecting all versions up to and including 1.0. The flaw allows unauthenticated attackers to extract SMTP credentials (username and password) from the WordPress configuration by invoking an improperly secured AJAX action handler. It was published on January 14, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The plugin registers a WordPress AJAX action handler that is accessible without authentication — meaning any unauthenticated HTTP request to the WordPress admin-ajax.php endpoint with the appropriate action parameter can trigger the handler. This handler returns SMTP configuration data, including plaintext credentials, from the WordPress settings. The vulnerable code is visible at line 309 of the plugin source file (Plugin Source, Wordfence).

Successful exploitation allows unauthenticated remote attackers to retrieve SMTP credentials stored in the WordPress configuration, directly compromising confidentiality. The exposed credentials can be used to access associated email accounts, send phishing or spam emails, or facilitate credential-stuffing attacks against other services if the same credentials are reused. There is no direct integrity or availability impact, but the credential exposure creates significant downstream risk for account takeover and lateral movement (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14464 as of the available data. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any attacker who can reach the WordPress site's admin-ajax.php endpoint (Wordfence).

1. Reconnaissance: Identify WordPress sites running the PDF Resume Parser plugin (version ≤ 1.0) using tools like WPScan, Shodan, or Google dorks targeting plugin-specific files.
2. Identify the AJAX action: Review the plugin source code (publicly available at the WordPress plugin repository) to identify the unauthenticated AJAX action name registered at line 309 of pdf-resume-parser.php.
3. Craft the request: Send an unauthenticated HTTP POST request to the target site's wp-admin/admin-ajax.php endpoint with the action parameter set to the vulnerable AJAX handler name, e.g.:

   POST /wp-admin/admin-ajax.php
   action=<vulnerable_action_name>

4. Extract credentials: Parse the JSON or text response returned by the handler, which contains the SMTP username and password from the WordPress configuration.
5. Leverage credentials: Use the extracted SMTP credentials to authenticate to the mail server, send emails as the site owner, or attempt credential reuse against other services (Plugin Source, Wordfence).

• Network: Unusual unauthenticated POST requests to /wp-admin/admin-ajax.php with an action parameter matching the PDF Resume Parser plugin's AJAX handler, originating from unexpected or automated IP addresses.
• Logs: WordPress access logs showing repeated or scripted POST requests to admin-ajax.php without a valid session cookie or nonce, particularly from scanning tools or unfamiliar user agents.
• Logs: SMTP server authentication logs showing login attempts or successful logins from unfamiliar IP addresses using the WordPress site's SMTP credentials shortly after the plugin was active.
• File System: Presence of the PDF Resume Parser plugin version 1.0 (pdf-resume-parser.php) in the WordPress plugins directory (/wp-content/plugins/pdf-resume-parser/).

The primary remediation is to deactivate and remove the PDF Resume Parser plugin (version ≤ 1.0) from WordPress installations, as no patched version has been publicly identified in the available data. Site administrators should immediately rotate any SMTP credentials configured in WordPress settings, as they may have been exposed. Additionally, SMTP credentials should be unique and not reused across other services to limit the impact of credential exposure. Restricting access to wp-admin/admin-ajax.php via firewall rules or a Web Application Firewall (WAF) can reduce the attack surface (Wordfence).