CVE-2025-14464 PDF Resume Parser <= 1.0 - Unauthenticated Sensitive Information Disclosure in SMTP Credentials
Unauthenticated attackers can extract SMTP credentials via an exposed AJAX handler, potentially compromising email accounts and other systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14464?
CVE-2025-14464 is a medium-severity vulnerability in kiwicommerce PDF Resume Parser, published on 14 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The PDF Resume Parser plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0. This is due to the plugin registering an AJAX action handler that is accessible to unauthenticated users and exposes SMTP configuration data including credentials. This makes it possible for unauthenticated attackers to extract sensitive SMTP credentials (username and password) from the WordPress configuration, which could be leveraged to compromise email accounts and potentially gain unauthorized access to other systems using the same credentials.
Weakness: CWE-200
Which versions are affected by CVE-2025-14464?
How do I fix CVE-2025-14464?
No fix has been published for CVE-2025-14464 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-14464 being exploited?
There is no known exploitation of CVE-2025-14464 in the wild and no public exploit code.
Sources
Also known as GHSA-8pqr-vvcp-m242.