PT-2026-2812 · WordPress · Pdf Resume Parser

Ivan Cese · Publicado 2026-01-14 · Atualizado 2026-01-14 · CVE-2025-14464

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PDF Resume Parser plugin for WordPress versions prior to 1.1

Description The PDF Resume Parser plugin for WordPress has a flaw that allows exposure of sensitive information. An AJAX action handler is accessible to users without authentication, revealing SMTP configuration data, including credentials. This allows unauthenticated attackers to extract SMTP credentials (username and password) from the WordPress configuration. Compromised email accounts and potential unauthorized access to other systems using the same credentials are possible consequences.

Recommendations Update the PDF Resume Parser plugin to version 1.1 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-14464

Produtos afetados

Pdf Resume Parser

Referências · 6

• https://twitter.com/CVEnew/status/2011382988928360522 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/pdf-resume-parser/tags/1.0/pdf-resume-parser.php#L309 · Nota
• https://twitter.com/VulmonFeeds/status/2011436575150797066 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/8a84bcc2-23e0-4624-89a4-7bbb1b34c498?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14464 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/pdf-resume-parser/trunk/pdf-resume-parser.php#L309 · Nota