CVE-2025-14074

MediumCVSS 4.3

Published: 12/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_duplicate' function in all versions up to and including 6.3.3. Authenticated attackers with Subscriber-level access and above can duplicate arbitrary posts, including password protected or private ones.

Risk Assessment

Attackers can create copies of private or protected posts, potentially leading to disclosure of sensitive content.

Recommendation

Update the plugin to a patched version. Restrict user permissions and monitor duplication operations.

Other vulnerabilities in PDF for Contact Form 7

CVE-2026-94664High
The PDF for Contact Form 7 plugin for WordPress contains a Path Traversal vulnerability in versions up to and including 7.1.0. An attacker can exploit this to read arbitrary files from the server.

Original NVD description (English source)

The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_duplicate' function in all versions up to, and including, 6.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to duplicate arbitrary posts, including password protected or private ones.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS