CVE-2025-14354

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14354", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-09T16:28:40.743Z", "datePublished": "2025-12-12T03:20:48.851Z", "dateUpdated": "2026-04-08T17:00:38.149Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:38.149Z"}, "affected": [{"vendor": "doubledome", "product": "Resource Library for Logged In Users", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to perform various unauthorized actions including creating, editing, and deleting resources and categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Resource Library for Logged In Users <= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actions", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71b82f1e-14ae-4eb3-9b46-5fcea1cd5a32?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/trunk/includes/class-ddrll.php#L406"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/tags/1.4/includes/class-ddrll.php#L406"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/trunk/includes/class-ddrll.php#L168"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/tags/1.4/includes/class-ddrll.php#L168"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/trunk/includes/class-ddrll.php#L530"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/tags/1.4/includes/class-ddrll.php#L530"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421955/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2025-12-11T15:10:16.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T21:07:12.586212Z", "id": "CVE-2025-14354", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T18:14:39.671Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14354", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T21:07:12.586212Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T21:03:02.365Z"}}], "cna": {"title": "Resource Library for Logged In Users <= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actions", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "doubledome", "product": "Resource Library for Logged In Users", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T15:10:16.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71b82f1e-14ae-4eb3-9b46-5fcea1cd5a32?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/trunk/includes/class-ddrll.php#L406"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/tags/1.4/includes/class-ddrll.php#L406"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/trunk/includes/class-ddrll.php#L168"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/tags/1.4/includes/class-ddrll.php#L168"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/trunk/includes/class-ddrll.php#L530"}, {"url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/tags/1.4/includes/class-ddrll.php#L530"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421955/"}], "descriptions": [{"lang": "en", "value": "The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to perform various unauthorized actions including creating, editing, and deleting resources and categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:38.149Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14354", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:00:38.149Z", "dateReserved": "2025-12-09T16:28:40.743Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T03:20:48.851Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Resource Library for Logged In Users", "vendor": "doubledome", "versions": [{"lessThanOrEqual": "1.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to perform various unauthorized actions including creating, editing, and deleting resources and categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Biblioteca de Recursos para Usuarios Autenticados para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.4, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en m\u00faltiples funciones administrativas. Esto hace posible que atacantes no autenticados realicen varias acciones no autorizadas, incluyendo la creaci\u00f3n, edici\u00f3n y eliminaci\u00f3n de recursos y categor\u00edas, a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-14354", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14354", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-12T21:07:12.586212Z", "version": "2.0.3"}}]}, "published": "2025-12-12T04:15:49.757", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/tags/1.4/includes/class-ddrll.php#L168"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/tags/1.4/includes/class-ddrll.php#L406"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/tags/1.4/includes/class-ddrll.php#L530"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/trunk/includes/class-ddrll.php#L168"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/trunk/includes/class-ddrll.php#L406"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/doubledome-resource-link-library/trunk/includes/class-ddrll.php#L530"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3421955/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71b82f1e-14ae-4eb3-9b46-5fcea1cd5a32?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:28:15.187992+00:00", "value": {"mitigation_remediation": ["Upgrade the Doubledome Resource Library for Logged In Users plugin to the latest version where nonce validation is implemented", "If the plugin is no longer required, disable or uninstall it to eliminate the risk surface", "Consider adding a security plugin that enforces nonce checks or restricts administrative actions to trusted users", "Regularly review and audit user permissions and monitor administrative activity logs for suspicious changes"], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Doubledome Resource Library for Logged In Users plugin version 1.5 or earlier are affected. The plugin is provided by the vendor doubledome.", "description_and_impact": "The vulnerability is a Cross\u2011Site Request Forgery due to missing nonce validation on several administrative functions of the Resource Library for Logged In Users plugin. An attacker can forge a request that, when a legitimate site administrator clicks a link or performs a similar action, will create, edit, or delete resources and categories. Because these changes affect site content and structure, the impact is to tamper with the site\u2019s integrity and availability for administrators and users.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests exploitation is unlikely but possible. The vulnerability is listed as not in CISA KEV, so no known active exploitation is reported. Exploitation typically requires social engineering to get an established administrator to submit a crafted request while authenticated. No additional technical prerequisites beyond the plugin\u2019s missing nonce have been identified, so the attack vector is primarily indirect phishing or malicious link usage."}}}}, "created": "2025-12-12T08:47:53.872659+00:00", "updated": "2026-04-21T17:30:37.703103+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}