What the vulnerability does
01Description
The PDF Resume Parser plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0. This is due to the plugin registering an AJAX action handler that is accessible to unauthenticated users and exposes SMTP configuration data including credentials. This makes it possible for unauthenticated attackers to extract sensitive SMTP credentials (username and password) from the WordPress configuration, which could be leveraged to compromise email accounts and potentially gain unauthorized access to other systems using the same credentials.
Explanation of Vulnerability in Simple Terms
02Summary
The PDF Resume Parser contains an information exposure vulnerability that allows unauthenticated attackers to read sensitive data over the network. No user interaction or special privileges are required. The vulnerability affects all versions up to and including 1.0. A patch version has not been publicly identified.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the application without authentication.
Potential impact on your site
04Site Impact
Sensitive data may be exposed to unauthorized users if the application is internet-facing.
Conditions required to exploit
05Prerequisites
Network access to the affected application; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 14, 2026
CVE published
April 8, 2026
Record updated
