PT-2026-2812 · WordPress · Pdf Resume Parser

Ivan Cese · Published 2026-01-14 · Updated 2026-01-14 · CVE-2025-14464

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PDF Resume Parser plugin for WordPress versions prior to 1.1

Description The PDF Resume Parser plugin for WordPress has a flaw that allows exposure of sensitive information. An AJAX action handler is accessible to users without authentication, revealing SMTP configuration data, including credentials. This allows unauthenticated attackers to extract SMTP credentials (username and password) from the WordPress configuration. Compromised email accounts and potential unauthorized access to other systems using the same credentials are possible consequences.

Recommendations Update the PDF Resume Parser plugin to version 1.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-14464

Affected Products

Pdf Resume Parser

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14464 · Security Note
• https://twitter.com/CVEnew/status/2011382988928360522 · Twitter Post
• https://plugins.trac.wordpress.org/browser/pdf-resume-parser/tags/1.0/pdf-resume-parser.php#L309 · Note
• https://twitter.com/VulmonFeeds/status/2011436575150797066 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8a84bcc2-23e0-4624-89a4-7bbb1b34c498?source=cve · Note
• https://plugins.trac.wordpress.org/browser/pdf-resume-parser/trunk/pdf-resume-parser.php#L309 · Note