What is the CVSS score of CVE-2025-14074?

CVE-2025-14074 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-14074

MEDIUM

Missing Authorization (CWE-862)

2025-12-12 security@wordfence.com

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 17:22 vuln.today

CVE Published

Dec 12, 2025 - 10:15 nvd

MEDIUM 4.3

DescriptionCVE.org

The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_duplicate' function in all versions up to, and including, 6.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to duplicate arbitrary posts, including password protected or private ones.

AnalysisAI

Authenticated attackers with Subscriber-level access can duplicate arbitrary WordPress posts via the PDF for Contact Form 7 + Drag and Drop Template Builder plugin (versions up to 6.3.3) due to missing capability checks in the 'rednumber_duplicate' function. This allows disclosure of sensitive content including password-protected and private posts. The vulnerability requires authentication but exploits insufficient privilege validation, creating a post enumeration and information disclosure risk for multi-user WordPress installations. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability stems from a missing capability check (CWE-862: Missing Authorization) in the 'rednumber_duplicate' WordPress AJAX function within the PDF for Contact Form 7 plugin backend. WordPress plugins implementing AJAX handlers must verify user capabilities using functions such as 'current_user_can()' before allowing sensitive operations. The 'rednumber_duplicate' function fails to validate whether an authenticated user possesses the required permissions (typically 'edit_posts' or post-type-specific capabilities) before duplicating posts. This allows any authenticated WordPress user-even those with minimal Subscriber-level permissions-to access the duplication endpoint and replicate posts they should not be able to modify. The vulnerability is particularly severe because post duplication can bypass WordPress's built-in access controls for password-protected and private content, exposing metadata and post content to unauthorized users.

Affected ProductsAI

The PDF for Contact Form 7 + Drag and Drop Template Builder WordPress plugin in all versions up to and including 6.3.3 is affected (CPE: wordpress:pdf-for-contact-form-7:<=6.3.3). The vulnerable code is documented in the plugin repository at backend/index.php line 697, confirmed in both the 6.3.2 tag and trunk branches. Wordfence threat intelligence confirms the vulnerability across these version ranges. Patched versions beyond 6.3.3 address the flaw via capability check implementation.

RemediationAI

Update the PDF for Contact Form 7 + Drag and Drop Template Builder plugin to version 6.3.4 or later, which includes proper capability checks in the 'rednumber_duplicate' function. Users should navigate to WordPress Dashboard > Plugins, search for 'PDF for Contact Form 7', and click 'Update Now'. If automatic updates are disabled, download the latest version from the official WordPress plugin repository. Until patching is possible, administrators can reduce risk by restricting Subscriber-level account creation and regularly auditing user permissions. For additional details, consult the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0d00b50c-949a-4fd0-9eab-3555d263fcc7 and the plugin repository change log.