The PDF Resume Parser plugin for WordPress contains a handler for an AJAX action that can be called by anyone without authentication. The handler returns the SMTP configuration stored in the WordPress settings, including the username and password. This leaks sensitive credentials and can enable an attacker to compromise the email account that the site uses or to exfiltrate further data using those credentials.

Any WordPress site that has installed the kiwicommerce PDF Resume Parser plugin in version 1.0 or earlier is impacted. The vulnerability exists in all releases up to and including 1.0 and affects any installation that has granted public access to the AJAX endpoint.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score is below 1%, meaning the likelihood of recent exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Because the AJAX action is unauthenticated, an attacker only needs the web address of the site to trigger the request. Successful exploitation results in the attacker learning the SMTP credentials, which could be used to send spam, phishing messages, or access a broader network that shares the same credentials. Since no privileged context is required, the attack is straightforward but the potential damage depends on how the credentials are used elsewhere.