What is the CVSS score of CVE-2025-14354?

CVE-2025-14354 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-14354

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-12 security@wordfence.com

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Dec 12, 2025 - 04:15 nvd

MEDIUM 4.3

DescriptionCVE.org

The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to perform various unauthorized actions including creating, editing, and deleting resources and categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in Resource Library for Logged In Users WordPress plugin (all versions up to 1.5) allows unauthenticated attackers to perform unauthorized administrative actions including creating, editing, and deleting resources and categories by tricking a site administrator into clicking a malicious link. The vulnerability stems from missing nonce validation on multiple administrative functions. With an EPSS score of 0.02% and low real-world exploitation probability despite the CVSS 4.3 score, this represents a lower-priority vulnerability requiring user interaction and administrative privileges on the target site.

Technical ContextAI

The vulnerability exploits missing nonce validation in WordPress administrative functions, violating the principle of CSRF protection mechanisms built into the WordPress plugin architecture. WordPress nonces are cryptographic tokens that verify requests originate from legitimate administrative actions rather than forged cross-site requests. The affected code in class-ddrll.php (specifically lines 168, 406, and 530 based on referenced source code locations) processes administrative operations without validating these nonces. The underlying cause is CWE-352 (Cross-Site Request Forgery), a server-side validation failure where the application trusts user-supplied requests without verifying their legitimacy. The plugin is 'Resource Library for Logged In Users' (also referenced as 'doubledome-resource-link-library' in the WordPress plugin directory), which manages resource and category data accessible only to authenticated users but administrable through the WordPress backend.

Affected ProductsAI

The Resource Library for Logged In Users WordPress plugin (doubledome-resource-link-library) in all versions up to and including 1.5 is affected. The WordPress plugin directory references indicate the vulnerability exists in both the tagged release versions (1.4 and earlier) and the development trunk. Users running version 1.5 or lower are impacted. Wordfence tracking (ID 71b82f1e-14ae-4eb3-9b46-5fcea1cd5a32) provides additional vulnerability intelligence; the WordPress plugin page at plugins.trac.wordpress.org/browser/doubledome-resource-link-library contains source code references documenting the vulnerable code locations.

RemediationAI

Update the Resource Library for Logged In Users plugin to version 1.6 or later, which includes proper nonce validation on all administrative functions. The WordPress plugin directory changeset 3421955 documents the fix implementation. Site administrators should navigate to their WordPress dashboard, go to Plugins > Installed Plugins, locate 'Resource Library for Logged In Users' or 'doubledome-resource-link-library', and click Update to version 1.6. As an interim workaround if updating is not immediately possible, restrict administrative access to trusted users only and educate administrators about not clicking suspicious links from untrusted sources. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/71b82f1e-14ae-4eb3-9b46-5fcea1cd5a32?source=cve for additional security guidance.