CVE-2025-14354
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
2Description
The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to perform various unauthorized actions including creating, editing, and deleting resources and categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Analysis
Cross-Site Request Forgery in Resource Library for Logged In Users WordPress plugin (all versions up to 1.5) allows unauthenticated attackers to perform unauthorized administrative actions including creating, editing, and deleting resources and categories by tricking a site administrator into clicking a malicious link. The vulnerability stems from missing nonce validation on multiple administrative functions. With an EPSS score of 0.02% and low real-world exploitation probability despite the CVSS 4.3 score, this represents a lower-priority vulnerability requiring user interaction and administrative privileges on the target site.
Technical Context
The vulnerability exploits missing nonce validation in WordPress administrative functions, violating the principle of CSRF protection mechanisms built into the WordPress plugin architecture. WordPress nonces are cryptographic tokens that verify requests originate from legitimate administrative actions rather than forged cross-site requests. The affected code in class-ddrll.php (specifically lines 168, 406, and 530 based on referenced source code locations) processes administrative operations without validating these nonces. The underlying cause is CWE-352 (Cross-Site Request Forgery), a server-side validation failure where the application trusts user-supplied requests without verifying their legitimacy. The plugin is 'Resource Library for Logged In Users' (also referenced as 'doubledome-resource-link-library' in the WordPress plugin directory), which manages resource and category data accessible only to authenticated users but administrable through the WordPress backend.
Affected Products
The Resource Library for Logged In Users WordPress plugin (doubledome-resource-link-library) in all versions up to and including 1.5 is affected. The WordPress plugin directory references indicate the vulnerability exists in both the tagged release versions (1.4 and earlier) and the development trunk. Users running version 1.5 or lower are impacted. Wordfence tracking (ID 71b82f1e-14ae-4eb3-9b46-5fcea1cd5a32) provides additional vulnerability intelligence; the WordPress plugin page at plugins.trac.wordpress.org/browser/doubledome-resource-link-library contains source code references documenting the vulnerable code locations.
Remediation
Update the Resource Library for Logged In Users plugin to version 1.6 or later, which includes proper nonce validation on all administrative functions. The WordPress plugin directory changeset 3421955 documents the fix implementation. Site administrators should navigate to their WordPress dashboard, go to Plugins > Installed Plugins, locate 'Resource Library for Logged In Users' or 'doubledome-resource-link-library', and click Update to version 1.6. As an interim workaround if updating is not immediately possible, restrict administrative access to trusted users only and educate administrators about not clicking suspicious links from untrusted sources. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/71b82f1e-14ae-4eb3-9b46-5fcea1cd5a32?source=cve for additional security guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today